sodinokibi | f442d0543f6df79be9fbaed90af2dedbcf2e4774561421763577b148a9ff8554

General

Target

v2.exe
Size

121KB
MD5

944ed18066724dc6ca3fb3d72e4b9bdf
SHA1

1a19c8793cd783a5bb89777f5bc09e580f97ce29
SHA256

74ce1be7fe32869dbbfe599d7992c306a7ee693eb517924135975daa64a3a92f
SHA512

a4d23cba68205350ae58920479cb52836f9c6dac20d1634993f3758a1e5866f40b0296226341958d1200e1fcd292b8138c41a9ed8911d7abeaa223a06bfe4ad3
SSDEEP

1536:vjVXKif7kaCtHM7qpo6ZQDtFnNi+ti09or2LkLpLik8ICS4Ao3uZs/WVEdz725sK:J1MZwlLk9Bm3uW/Wud2K36cn/wCY

Score

10^/10

sodinokibi ransomware spyware stealer

Malware Config

Extracted

Path

C:\ProgramData\oitd618-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension oitd618. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/66EFD50C7CD78C48 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/66EFD50C7CD78C48 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: UaGiRjW4GJrpFEKKjV69WOpG39uqXwKwLUp6IPRZu7mwHrsYg58KCm7BcylvhiMG WdhBqRppHjXd+yWmHXDV44mdERwelGd+Z6Jp3cF3hy54OsYMvjTsh+abPN0dTaH3 bXXFbkM9jC190A3Wr7MpBgKH5wx+rllweOGZlnoORdxm0NpfuP0M37dgNr/BDTVS yS45Ng7cvPJrJBP1QgftxaU6rOMHpU4mwWfzLS2a1p8zGOlxPnv0TcRtfKuaZFbR gX0XJG4xqMnDllgQqMEGrESxEoUErjn+UVcs8UfbvMUGpKiW1WRTZYhTK/tNqi6w CDreyxZQcstgY8/jqOaZEUcKcVsKTC1wBcHcasTvHEsYhY/tn7WN8JsOdLyE69uV aQvgLBOUoZQ6UYaDxfboMX1KYY0lsMjtXHMTYBjqq3zo4eDZH3qEcBbgzryOSz9U t30qQNDKN3zt0v+VHPk4FxuMpfF3f8XqWvfB1HSR3tl9NUiR4Cvi7v3R4UlRxFuz /seTRkZPuzTlCa3E+wARPdOTNIbQF8+yOdV4flkhtQv3PyxB5M+9c/JRPw6nFCW7 cLyIaX5W+majzXlkE3nhLci70kUi2nWssuiLXw+kxhTZb/JnS+5gxGLvIvsnQETL OWOZoiGPaP4J/LAs7mE7VfHeQcysL0Tr6infpAHY+IgmkMyMqDLlft9XxE7gNekc XKZkq2GGg9960senqiaYrMp1EAEQlGVkSMKL2xdbabQEYAPMepBvpNC9p9BE/0zV WT8PNDc6RzhhmOIHQVJwEbvcahgd5WxDer9mYQ1wW558J38wEfmgiSX1FCF1o752 NIz/mSA6QhYYoqS1resB9CUyOQS8VS1qA1xX0ppxDOy0zSIcVmPBy5s1PdkbBmWa Csa/OK91zFjdg0kO929HiqZxMuxBeQVrJ1hmfcxP6ihKGq7lQpNgcAtIbV4AbkiQ PWcUuS4s56MjX1V9kiRyOQv6Qbk+BPQbcK+AYP3uabETKZJJ2CcnQaEVYL2GGjzG yfvd3hnaaKnQKw4wPaZuEG5r6lDJMjnuCEjcI3jsjjgfy99VoZD1mCi9pbyMPzA5 Ak2hnLDltrPZXOoiXA4xEZ0NjjBPZHKvew4hS5yDOYph9I1upjBH6QxpeiAITfKg +qzaj6ukw5UAg7NVB/wDitZi10Bjqxe2/YWeSHE1+DJlOccRwD4GGXN7p2/fKEgo Qv+H5U8V27FimFrRO2xN/zopZ+bOgxMnHAuYcAkgYog73DTyhZAW4HiiBvmmVp3l wbBMb62u4GlA0q61TCxPiObOwogjZDOGvVrxgdjnLnLJhqJVM8HD4pW7ULXRf0jI F55juZhTf4QAW3zs2wez9Sr9005MUImxTZ+u//3k ----------------------------------------------------------------------------------------- We will use the data gathered from your systems in future campaigns in 14 days !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/66EFD50C7CD78C48

http://decoder.re/66EFD50C7CD78C48

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Drops startup file 1 IoCs

Processes:

v2.exe

description ioc process

File created \??\c:\users\admin\appdata\roaming\microsoft\word\startup\oitd618-readme.txt v2.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

description	ioc	process
File created	\??\c:\users\admin\appdata\roaming\microsoft\word\startup\oitd618-readme.txt	v2.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

v2.exe

description	ioc	process
File opened (read-only)	\??\H:	v2.exe
File opened (read-only)	\??\L:	v2.exe
File opened (read-only)	\??\P:	v2.exe
File opened (read-only)	\??\W:	v2.exe
File opened (read-only)	\??\B:	v2.exe
File opened (read-only)	\??\R:	v2.exe
File opened (read-only)	\??\F:	v2.exe
File opened (read-only)	\??\K:	v2.exe
File opened (read-only)	\??\T:	v2.exe
File opened (read-only)	\??\D:	v2.exe
File opened (read-only)	\??\S:	v2.exe
File opened (read-only)	\??\G:	v2.exe
File opened (read-only)	\??\J:	v2.exe
File opened (read-only)	\??\Q:	v2.exe
File opened (read-only)	\??\U:	v2.exe
File opened (read-only)	\??\Z:	v2.exe
File opened (read-only)	\??\E:	v2.exe
File opened (read-only)	\??\V:	v2.exe
File opened (read-only)	\??\Y:	v2.exe
File opened (read-only)	\??\M:	v2.exe
File opened (read-only)	\??\N:	v2.exe
File opened (read-only)	\??\A:	v2.exe
File opened (read-only)	\??\O:	v2.exe
File opened (read-only)	\??\X:	v2.exe
File opened (read-only)	\??\I:	v2.exe

Drops file in Program Files directory 23 IoCs

Processes:

v2.exe

description	ioc	process
File created	\??\c:\program files\oitd618-readme.txt	v2.exe
File opened for modification	\??\c:\program files\ClearDebug.3g2	v2.exe
File opened for modification	\??\c:\program files\ConvertToSkip.aiff	v2.exe
File opened for modification	\??\c:\program files\ExportTest.wdp	v2.exe
File opened for modification	\??\c:\program files\MergeEdit.dotm	v2.exe
File opened for modification	\??\c:\program files\InitializePush.vstx	v2.exe
File opened for modification	\??\c:\program files\JoinSend.mpe	v2.exe
File opened for modification	\??\c:\program files\MeasureRemove.xltx	v2.exe
File opened for modification	\??\c:\program files\SyncOut.svgz	v2.exe
File opened for modification	\??\c:\program files\SearchLock.js	v2.exe
File opened for modification	\??\c:\program files\SendProtect.pcx	v2.exe
File opened for modification	\??\c:\program files\UndoRevoke.jpe	v2.exe
File created	\??\c:\program files (x86)\oitd618-readme.txt	v2.exe
File opened for modification	\??\c:\program files\ApproveRename.otf	v2.exe
File opened for modification	\??\c:\program files\ConfirmSync.wps	v2.exe
File opened for modification	\??\c:\program files\FormatResume.dwg	v2.exe
File opened for modification	\??\c:\program files\JoinDisconnect.xlsm	v2.exe
File opened for modification	\??\c:\program files\UseSkip.xla	v2.exe
File opened for modification	\??\c:\program files\HideCopy.docx	v2.exe
File opened for modification	\??\c:\program files\ResolveClear.csv	v2.exe
File opened for modification	\??\c:\program files\SelectWait.mpg	v2.exe
File opened for modification	\??\c:\program files\SendExport.mpeg3	v2.exe
File opened for modification	\??\c:\program files\UpdateReset.DVR	v2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

v2.exe

pid process

4976 v2.exe
4976 v2.exe
4976 v2.exe
4976 v2.exe
4976 v2.exe
4976 v2.exe
4976 v2.exe
4976 v2.exe

pid	process
4976	v2.exe
4976	v2.exe
4976	v2.exe
4976	v2.exe
4976	v2.exe
4976	v2.exe
4976	v2.exe
4976	v2.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

v2.exevssvc.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	4976	v2.exe
Token: SeTakeOwnershipPrivilege	4976	v2.exe
Token: SeBackupPrivilege	1496	vssvc.exe
Token: SeRestorePrivilege	1496	vssvc.exe
Token: SeAuditPrivilege	1496	vssvc.exe
Token: SeManageVolumePrivilege	5488	svchost.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\v2.exe
"C:\Users\Admin\AppData\Local\Temp\v2.exe"
1⤵
- Drops startup file
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4976

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3052

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1496

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy
1⤵
PID:2024

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5488

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy
1⤵
PID:5288

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\oitd618-readme.txt
Filesize
7KB

MD5
bc91618cbaf3b9d2662e7e8088494798

SHA1
138d85b6a68efafff88cc6b3d43ee276fcb2c4fb

SHA256
e14ad66101022e5293afa16507f5838dc9522340e4d8600723a0dbe9c3d6a5b2

SHA512
a0bef39bfe2216a77e6a7dee05d5546c98d404e12f93ad27c3bbdb15fba16bc868830ea41f7eaf840105626a469687d6f8f428a659ff3833a1c8c5c90af8d41a

Download Submit
memory/5488-5080-0x000002B543E80000-0x000002B543E90000-memory.dmp

Filesize
64KB

Download
memory/5488-5096-0x000002B543F80000-0x000002B543F90000-memory.dmp

Filesize
64KB

Download
memory/5488-5115-0x000002B54C1B0000-0x000002B54C1B1000-memory.dmp

Filesize
4KB

Download
memory/5488-5117-0x000002B54C2F0000-0x000002B54C2F1000-memory.dmp

Filesize
4KB

Download
memory/5488-5119-0x000002B54C2F0000-0x000002B54C2F1000-memory.dmp

Filesize
4KB

Download
memory/5488-5120-0x000002B54C300000-0x000002B54C301000-memory.dmp

Filesize
4KB

Download
memory/5488-5121-0x000002B54C300000-0x000002B54C301000-memory.dmp

Filesize
4KB

Download
memory/5488-5122-0x000002B54C300000-0x000002B54C301000-memory.dmp

Filesize
4KB

Download
memory/5488-5123-0x000002B54C320000-0x000002B54C321000-memory.dmp

Filesize
4KB

Download
memory/5488-5124-0x000002B54C320000-0x000002B54C321000-memory.dmp

Filesize
4KB

Download
memory/5488-5125-0x000002B54C320000-0x000002B54C321000-memory.dmp

Filesize
4KB

Download
memory/5488-5126-0x000002B54C320000-0x000002B54C321000-memory.dmp

Filesize
4KB

Download
memory/5488-5127-0x000002B54C320000-0x000002B54C321000-memory.dmp

Filesize
4KB

Download
memory/5488-5128-0x000002B54C320000-0x000002B54C321000-memory.dmp

Filesize
4KB

Download
memory/5488-5129-0x000002B54C320000-0x000002B54C321000-memory.dmp

Filesize
4KB

Download
memory/5488-5130-0x000002B54C320000-0x000002B54C321000-memory.dmp

Filesize
4KB

Download
memory/5488-5131-0x000002B54C320000-0x000002B54C321000-memory.dmp

Filesize
4KB

Download
memory/5488-5132-0x000002B54C320000-0x000002B54C321000-memory.dmp

Filesize
4KB

Download
memory/5488-5133-0x000002B54C320000-0x000002B54C321000-memory.dmp

Filesize
4KB

Download
memory/5488-5134-0x000002B54C320000-0x000002B54C321000-memory.dmp

Filesize
4KB

Download
memory/5488-5135-0x000002B54C320000-0x000002B54C321000-memory.dmp

Filesize
4KB

Download
memory/5488-5136-0x000002B54C320000-0x000002B54C321000-memory.dmp

Filesize
4KB

Download
memory/5488-5137-0x000002B54C320000-0x000002B54C321000-memory.dmp

Filesize
4KB

Download
memory/5488-5138-0x000002B54C320000-0x000002B54C321000-memory.dmp

Filesize
4KB

Download
memory/5488-5139-0x000002B54C320000-0x000002B54C321000-memory.dmp

Filesize
4KB

Download
memory/5488-5140-0x000002B54C320000-0x000002B54C321000-memory.dmp

Filesize
4KB

Download
memory/5488-5141-0x000002B54C330000-0x000002B54C331000-memory.dmp

Filesize
4KB

Download
memory/5488-5143-0x000002B54C340000-0x000002B54C341000-memory.dmp

Filesize
4KB

Download
memory/5488-5142-0x000002B54C330000-0x000002B54C331000-memory.dmp

Filesize
4KB

Download
memory/5488-5145-0x000002B54C390000-0x000002B54C391000-memory.dmp

Filesize
4KB

Download
memory/5488-5146-0x000002B54C390000-0x000002B54C391000-memory.dmp

Filesize
4KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads