sodinokibi | 329983dc2a23bd951b24780947cb9a6ae3fb80d5ef546e8538dfd9459b176483

General

Target

revil.exe
Size

119KB
MD5

a4331ff805b0a8f2a2892777c224b65e
SHA1

2c5521077dd1a6f5f3558351370880aee9ab7c71
SHA256

329983dc2a23bd951b24780947cb9a6ae3fb80d5ef546e8538dfd9459b176483
SHA512

786a6ffdd7206b0f11dd45921826e3685fe4b64b82b4fa26702a30dcb762d4310b3b55683a8c510175ed6a9086125156e676caa3220597f8ed7298f6cdc51799
SSDEEP

3072:KW5yc3Y4SMQwuOekD96R928A2fFM+/uSxo+HHz/bs/k4OS:K83Y5BAxa92c1rxTnz/Y/k4O

Score

10^/10

sodinokibi $2b$13$wz1rerfdlg.aistldqg5jeqqysemspatwkhdwbpwvrc3ty7akscg6 58 ransomware

Malware Config

Extracted

Family

sodinokibi

Botnet

$2b$13$wz1reRfdLg.aiStLDqg5JeqqySemSPatWKHdwbpWVrC3ty7Akscg6

Campaign

58

Attributes

net
false
pid
$2b$13$wz1reRfdLg.aiStLDqg5JeqqySemSPatWKHdwbpWVrC3ty7Akscg6
prc
vsnapvss
EnterpriseClient
firefox
infopath
cvd
tv_x64.exe
VeeamTransportSvc
steam
encsvc
mydesktopservice
outlook
synctime
ocssd
SAP
cvfwd
bengien
vxmon
bedbh
ocomm
ocautoupds
raw_agent_svc
oracle
disk+work
powerpnt
saposcol
sqbcoreservice
sapstartsrv
beserver
saphostexec
dbeng50
isqlplussvc
CVODS
DellSystemDetect
CVMountd
TeamViewer.exe
dbsnmp
thunderbird
mspub
wordpad
visio
benetns
QBCFMonitorService
TeamViewer_Service.exe
tv_w32.exe
QBIDPService
winword
thebat
VeeamDeploymentSvc
avagent
QBDBMgrN
mydesktopqos
xfssvccon
sql
tbirdconfig
CagService
pvlsvr
avscc
VeeamNFSSvc
onenote
excel
msaccess
agntsvc
ransom_oneliner
All of your files are encrypted! Find {EXT}-README.txt and follow instuctions
ransom_template
---=== Welcome. Again. ===--- [+] What's Happened? [+] Your files have been encrypted and currently unavailable. You can check it. All files in your system have {EXT} extension. By the way, everything is possible to recover (restore) but you should follow our instructions. Otherwise you can NEVER return your data. [+] What are our guarantees? [+] It's just a business and we care only about getting benefits. If we don't meet our obligations, nobody will deal with us. It doesn't hold our interest. So you can check the ability to restore your files. For this purpose you should visit our website where you can decrypt one file for free. That is our guarantee. It doesn't metter for us whether you cooperate with us or not. But if you don't, you'll lose your time and data cause only we have the private key to decrypt your files. In practice - time is much more valuable than money. [+] How to get access to our website? [+] Use TOR browser: 1. Download and install TOR browser from this site: https://torproject.org/ 2. Visit our website: http://4to43yp4mng2gdc3jgnep5bt7lkhqvjqiritbv4x2ebj3qun7wz4y2id.onion When you visit our website, put the following data into the input form: Key: {KEY} !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software or antivirus solutions to restore your data - it may entail the private key damage and as a result all your data loss! !!! !!! !!! ONE MORE TIME: It's in your best interests to get your files back. From our side we (the best specialists in this sphere) ready to make everything for restoring but please do not interfere. !!! !!! !!
sub
58
svc
QBCFMonitorService
thebat
dbeng50
winword
dbsnmp
VeeamTransportSvc
disk+work
TeamViewer_Service.exe
firefox
QBIDPService
steam
onenote
CVMountd
cvd
VeeamDeploymentSvc
VeeamNFSSvc
bedbh
mydesktopqos
avscc
infopath
cvfwd
excel
beserver
powerpnt
mspub
synctime
QBDBMgrN
tv_w32.exe
EnterpriseClient
msaccess
ocssd
mydesktopservice
sqbcoreservice
CVODS
DellSystemDetect
oracle
ocautoupds
wordpad
visio
SAP
bengien
TeamViewer.exe
agntsvc
CagService
avagent
ocomm
outlook
saposcol
xfssvccon
isqlplussvc
pvlsvr
sql
tbirdconfig
vxmon
benetns
tv_x64.exe
encsvc
sapstartsrv
vsnapvss
raw_agent_svc
thunderbird
saphostexec

Extracted

Path

C:\Recovery\6j217dy0-README.txt

Ransom Note

---=== Welcome. Again. ===--- [+] What's Happened? [+] Your files have been encrypted and currently unavailable. You can check it. All files in your system have 6j217dy0 extension. By the way, everything is possible to recover (restore) but you should follow our instructions. Otherwise you can NEVER return your data. [+] What are our guarantees? [+] It's just a business and we care only about getting benefits. If we don't meet our obligations, nobody will deal with us. It doesn't hold our interest. So you can check the ability to restore your files. For this purpose you should visit our website where you can decrypt one file for free. That is our guarantee. It doesn't metter for us whether you cooperate with us or not. But if you don't, you'll lose your time and data cause only we have the private key to decrypt your files. In practice - time is much more valuable than money. [+] How to get access to our website? [+] Use TOR browser: 1. Download and install TOR browser from this site: https://torproject.org/ 2. Visit our website: http://4to43yp4mng2gdc3jgnep5bt7lkhqvjqiritbv4x2ebj3qun7wz4y2id.onion When you visit our website, put the following data into the input form: Key: Mw2HsVWl4X2q+sfyrFDRcmMWcyIRBpjHaeAYnM2yX4KxXVrabxwT3eaKIG2Su4+n NJAYVooJAZN6aBUomEgI0tsLIFJD9OOLqHl48NbPxAAYZweJa846TCROaTeOhVaG cdBhwsY217CuUWlv1zSzdZPk1H+BB8yNXP8RliL9tIClTyaZIwjCb8cc2Xrfgx2D drGV1enSkAPUgX9l4ONvtq+R/qRWR7GA3H2mISqZNgHf2NvdlIuxz/AOg+6eh3+h RkkiKIZ3Ip0s8suCX+uBCpLoTrlln4u3eX06fgKq0hf6qkFW+fcxCtoKW6RsdPtu mHdtF353bQ2iBk44E4tpumFwT3PGkY6gmjyinv/LwxOWYlo7f+7HNoIjQdnWbign 5gpXVXzjHYylHKe8svlsMOUNa7k9BDXEL4yTAiY+vl5VscaM2vbIgeLQrvtGmF1l gnJo+LZaWZk7Q/0NA1+lvyYnah4zt672yv0UyRu4z5IUAUngw43enh+hOJb2mWWy 1fDnrEFi3t68c5Xw2x+/nGnfzJy5Tu/HJfM0ElJmtM8WjpjoTwEWtwHWBS7aCpXw SjNdLGEXufX6r+yXh0jZStBA9n1OvWOwFXcZoAR0SQy8wHeVJNOJNwS1ClMKI1bM e2UgcET2vR0gwrTGbn+TX5VDeiDirzhc05ofRa5QkzGjSpo0oPVitFx2/8BRodUP l1skPUB3gctnMLIbpapBV9NRlUX/2KjAkdIP0/loPAf0z2Op4pV4OoRftq7SI5cZ Yc756OoBaWB4pc9jwQAZQsp3DRLEBdujOuHWNKBfvI7cXbU9IEGGP4U5u8wxv29v oF8P46BfxAVfdsckNRo+wSccLu5bALBxzE4eI05xkTE4SfY05GMFRNYfUTsz3Q3w ZwGr2Omr3AEtfIE4i88KGja5715jaaqXOVEQbYTaSL/RMLBi+JssJwa6PxBhdxZm YCBJi2ZCwVMdyDY3LE2LfwIsUj5G1cnIG+oRdOsHSzZcfJ+Qy5e7xIbhsWROhMO0 8h+1LtrGqKnKusy+PgRIGSgRhILEPgm82g4tgD0a5iXWcML9ByPSxdR1DoQ3zKIL Y2O7VW7pT1W6PQSflldJVrdQYo970Yz4slKKh921uyDzTBu32OaRdOIAfsXq9732 85pHdix1cbmsXL/OFYDW9i3MsgEI81AWwQAYa4LL0gO5uBXXfEAL0aFu1OgaP4U9 g61FnxCyTHvrFSLcfTN3nB7acGa4ON+2zHT0SzZ+luhRNWEz8uJzQlmQhAVYHYtp TAhcL2lsWq4ghFew9+9jVuF1fzBqrcciTzLs4k/K9oIZ7vF+DDMDp8kgt4oz2bYe sPzQzi7oAauOETVplDvVsIJY9fj6oX5vq09pCm1hLV47Y2yFyvs= !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software or antivirus solutions to restore your data - it may entail the private key damage and as a result all your data loss! !!! !!! !!! ONE MORE TIME: It's in your best interests to get your files back. From our side we (the best specialists in this sphere) ready to make everything for restoring but please do not interfere. !!! !!! !!

URLs

http://4to43yp4mng2gdc3jgnep5bt7lkhqvjqiritbv4x2ebj3qun7wz4y2id.onion

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

revil.exe

description	ioc	process
File opened (read-only)	\??\U:	revil.exe
File opened (read-only)	\??\B:	revil.exe
File opened (read-only)	\??\O:	revil.exe
File opened (read-only)	\??\R:	revil.exe
File opened (read-only)	\??\T:	revil.exe
File opened (read-only)	\??\X:	revil.exe
File opened (read-only)	\??\A:	revil.exe
File opened (read-only)	\??\G:	revil.exe
File opened (read-only)	\??\K:	revil.exe
File opened (read-only)	\??\L:	revil.exe
File opened (read-only)	\??\Q:	revil.exe
File opened (read-only)	\??\S:	revil.exe
File opened (read-only)	\??\W:	revil.exe
File opened (read-only)	\??\D:	revil.exe
File opened (read-only)	\??\H:	revil.exe
File opened (read-only)	\??\E:	revil.exe
File opened (read-only)	\??\J:	revil.exe
File opened (read-only)	\??\P:	revil.exe
File opened (read-only)	\??\I:	revil.exe
File opened (read-only)	\??\Y:	revil.exe
File opened (read-only)	\??\Z:	revil.exe
File opened (read-only)	\??\F:	revil.exe
File opened (read-only)	\??\M:	revil.exe
File opened (read-only)	\??\N:	revil.exe
File opened (read-only)	\??\V:	revil.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

revil.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\p5yk9.bmp"	revil.exe

Drops file in Program Files directory 18 IoCs

Processes:

revil.exe

description	ioc	process
File opened for modification	\??\c:\program files\OpenHide.wvx	revil.exe
File opened for modification	\??\c:\program files\RedoStart.pptm	revil.exe
File created	\??\c:\program files\6j217dy0-README.txt	revil.exe
File created	\??\c:\program files (x86)\6j217dy0-README.txt	revil.exe
File opened for modification	\??\c:\program files\BlockUnprotect.ex_	revil.exe
File opened for modification	\??\c:\program files\InstallConvert.vstx	revil.exe
File opened for modification	\??\c:\program files\SwitchShow.avi	revil.exe
File opened for modification	\??\c:\program files\CheckpointImport.rm	revil.exe
File opened for modification	\??\c:\program files\ConfirmFormat.nfo	revil.exe
File opened for modification	\??\c:\program files\MountImport.mpeg	revil.exe
File opened for modification	\??\c:\program files\ProtectComplete.tiff	revil.exe
File opened for modification	\??\c:\program files\ImportStep.pot	revil.exe
File opened for modification	\??\c:\program files\OptimizeRestart.001	revil.exe
File opened for modification	\??\c:\program files\ProtectFind.odt	revil.exe
File opened for modification	\??\c:\program files\UseEnable.jtx	revil.exe
File opened for modification	\??\c:\program files\ExportCopy.sql	revil.exe
File opened for modification	\??\c:\program files\UnprotectRevoke.ttf	revil.exe
File opened for modification	\??\c:\program files\WatchAdd.wmf	revil.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

revil.exepowershell.exe

pid process

3112 revil.exe
3112 revil.exe
4520 powershell.exe
4520 powershell.exe

pid	process
3112	revil.exe
3112	revil.exe
4520	powershell.exe
4520	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

revil.exepowershell.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	3112	revil.exe
Token: SeDebugPrivilege	4520	powershell.exe
Token: SeBackupPrivilege	2788	vssvc.exe
Token: SeRestorePrivilege	2788	vssvc.exe
Token: SeAuditPrivilege	2788	vssvc.exe
Token: SeTakeOwnershipPrivilege	3112	revil.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

revil.exe

description	pid	process	target process
PID 3112 wrote to memory of 4520	3112	revil.exe	powershell.exe
PID 3112 wrote to memory of 4520	3112	revil.exe	powershell.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\revil.exe
"C:\Users\Admin\AppData\Local\Temp\revil.exe"
1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3112

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4520

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1824

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2788

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1

T1491

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\6j217dy0-README.txt
Filesize
6KB

MD5
78352e2ab83e701ff00970f250f01ad7

SHA1
e9cddfe07aa22bb58f6f4ffb925988cce5bd57ad

SHA256
017c818be4f80d7dc88a9e237d47650ac66f881ad82a713075ba29a5bddefc06

SHA512
ead0a1c6ae3990a453ab9b0a115af22147c9a3439bc60d969e4349f73a7b215904777905e7dc29125deff6ee4e96b47382b223c3e3709464f6bf87f5d9ff801c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_32d5nmla.wf1.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/3112-0-0x00000000010D0000-0x00000000010F0000-memory.dmp

Filesize
128KB

Download
memory/3112-18-0x00000000010D0000-0x00000000010F0000-memory.dmp

Filesize
128KB

Download
memory/3112-1-0x00000000010D0000-0x00000000010F0000-memory.dmp

Filesize
128KB

Download
memory/3112-438-0x00000000010D0000-0x00000000010F0000-memory.dmp

Filesize
128KB

Download
memory/3112-439-0x00000000010D0000-0x00000000010F0000-memory.dmp

Filesize
128KB

Download
memory/3112-456-0x00000000010D0000-0x00000000010F0000-memory.dmp

Filesize
128KB

Download
memory/4520-7-0x0000026B627A0000-0x0000026B627C2000-memory.dmp

Filesize
136KB

Download
memory/4520-12-0x00007FF87F250000-0x00007FF87FD11000-memory.dmp

Filesize
10.8MB

Download
memory/4520-13-0x0000026B7A9E0000-0x0000026B7A9F0000-memory.dmp

Filesize
64KB

Download
memory/4520-14-0x0000026B7A9E0000-0x0000026B7A9F0000-memory.dmp

Filesize
64KB

Download
memory/4520-17-0x00007FF87F250000-0x00007FF87FD11000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads