sodinokibi | 46e42d0057ba8c5af93fde464e1541ab985349bab37a64dc2ebc55bfa92d5b3e

Analysis

max time kernel
139s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/04/2024, 13:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
Size

166KB
MD5

8cbc25e4d5c3dd1ee950c9eaaa67049d
SHA1

2e3bc332df0adf7b9aaffad3e91d55463c858fd4
SHA256

5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6
SHA512

ea5326a5535995aa6a6754e3cc24096a8d27a23eed9bcbcf8849e59e9d341eaf7022c0524a5d15ccdb0405dcabe43d18f8587d12c79b4bfb50211ed7d51dd97e
SSDEEP

3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3QZcl+UNO:ZJ0BXScFy2RsQJ8zgZcl+U

Score

10^/10

sodinokibi persistence ransomware

Malware Config

Extracted

Path

C:\Recovery\4vli1xx-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 4vli1xx. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/966F9E313980EB78 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/966F9E313980EB78 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: TNXEcDg8aySqnyIkKLzfjXcNrhwiuhHJQfM6oIb5vwHVJt/BLR0JFkc830knIG1D 0WAgSHq1TS1+aJOmX1EOjOmufTqxC9R2WBAviagT0olr8zoCnl0iDUeSJRSViUpE EE+s4NTRh7SXzU9XoLeR+4uLgHNTiPQkh4KfjMLZiueCZspAqnRvo6NtGKmup+al lDH5G9rKcStTCoNQM0kJ6CCz8PVXCGJbCulJiY7Hm53wZDwrXobig6rPwYJzQBpb ZPZ5esX9Pv+nDxkok5eNQ2b/N+GgnxXhmczzCy0LVQPajT4sIvZNnQltWc4S5CPX 5V5co7sz6OxEOD4Kcm5LaQNY9Z0qT/KfWXgBS/E36mmkiDATVpfeKYvPDB6MgtxA f+vSOXzfM7+dk8HDJGvzhwViScTW8IZI6/GBDJeEL17Eq+/9eTfir1RNfkRzMD/u zt7BoZXT+cbxIFeo/A5gYxSyRdpkf96Y30b6rlM4J3AEki2kROIL322cJCRBzDlp nvYMLEXc8Yra2gsTVd/TSkdai0/wNGAOt1qeYszSGSjHMUgzRQYz0JbDuzeOuljh NtfZ4dVX7xZ/y6lrxtZDH5abtTqy20c+Z8Dk9FcN1q7HbsCMahObgAt+ugroj/rJ D+dBAsqZBnIq6cRiwbOF+ot+7zppaY0d5PD2/09aHtcL4xcUotnhOxg2i40R2JLx uT7now8T1lYy5CST79vBGIMrhIXUK6WTqoEEDAyXf3eLYodebXY1y0eh1hpLlhEp SGbSmTq+Td2KB1WRtfaCkLWJrGHRD8W+XVwzFzX5fUloSwhgddvfdBV4kNOiF87h FAXlNXbY0WcP21iSWs2p4hAS/l71IV1sq+iHtu8rWklNK5Z0CHfsoOOkjkaRVlXf 7ktSAl6BHPnrvJGFQ2qRg3SOzyLfBj4M/4x1u+im73F2yrAlfycfKl9/7dO/unxq Gm+qfSOyHOtRU9ieLh3pQAZW/qAw1S8RfC7BWWZ082MVO9jZ7Bd47hhmFLrbeBpM DWBCErSBEhZz262Bz1jqskbatZ67wFM2VvEYwnrgbrrn9I7QvSH5R1+ZZUIR4p0o 8wGTUX1z2BTsXk80QK1pRuGCkSg/D4GIl9/dFiwEx8aua2F0b5W5grsXZQfuxDbQ b2DGkg8ew9xCQFwG9/yWVlL3+xAhJeSZcOMoPkG2cFBcuLqE767j3CNjdByXEZUN mp/SpP1SwlQvqgXVIu8HgCPCJWXw63mNiSBdv5Xgfp9emBdffWaijAEfc8giI7VD 1KJVwzMY5NH8Ab9WaFiAcl8n+HI52r2NY8VtxOeDFOnp7BrLw9MSE6rFH7qNfEUe mda6bJnpTTFtImrELQUcaT3A9FqJdXz/WSF+JQExVznDp0nNhqcVhA== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/966F9E313980EB78

http://decryptor.cc/966F9E313980EB78

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\k51299BQXH = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe"	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened (read-only)	\??\L:	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened (read-only)	\??\M:	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened (read-only)	\??\R:	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened (read-only)	\??\W:	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened (read-only)	\??\N:	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened (read-only)	\??\P:	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened (read-only)	\??\G:	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened (read-only)	\??\K:	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened (read-only)	\??\U:	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened (read-only)	\??\D:	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened (read-only)	\??\H:	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened (read-only)	\??\J:	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened (read-only)	\??\E:	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened (read-only)	\??\I:	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened (read-only)	\??\S:	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened (read-only)	\??\F:	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened (read-only)	\??\B:	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened (read-only)	\??\O:	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened (read-only)	\??\Q:	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened (read-only)	\??\T:	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened (read-only)	\??\X:	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened (read-only)	\??\Y:	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened (read-only)	\??\V:	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened (read-only)	\??\Z:	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2ucy9f.bmp"	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe

Drops file in Program Files directory 31 IoCs

description	ioc	Process
File created	\??\c:\program files\4vli1xx-readme.txt	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened for modification	\??\c:\program files\BackupSet.ogg	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened for modification	\??\c:\program files\StepUninstall.ttc	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened for modification	\??\c:\program files\SuspendRestore.M2T	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened for modification	\??\c:\program files\CheckpointCopy.shtml	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened for modification	\??\c:\program files\CloseCompress.odt	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened for modification	\??\c:\program files\ConvertToOpen.AAC	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened for modification	\??\c:\program files\TraceDisconnect.TS	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened for modification	\??\c:\program files\MoveAdd.docm	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened for modification	\??\c:\program files\StopExport.M2TS	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened for modification	\??\c:\program files\TraceAdd.iso	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened for modification	\??\c:\program files\AssertExit.wax	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened for modification	\??\c:\program files\ConvertStep.xltx	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened for modification	\??\c:\program files\ExportAdd.potm	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened for modification	\??\c:\program files\BackupGet.wma	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened for modification	\??\c:\program files\DisconnectAdd.avi	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened for modification	\??\c:\program files\RevokeApprove.ram	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened for modification	\??\c:\program files\PingWatch.wma	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened for modification	\??\c:\program files\ReadMerge.vsdm	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened for modification	\??\c:\program files\RepairPush.tif	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened for modification	\??\c:\program files\ResolveSelect.gif	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File created	\??\c:\program files (x86)\4vli1xx-readme.txt	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened for modification	\??\c:\program files\ApproveSelect.jpeg	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened for modification	\??\c:\program files\ConvertFromSave.xml	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened for modification	\??\c:\program files\ConfirmFind.rar	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened for modification	\??\c:\program files\MergeRequest.tiff	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened for modification	\??\c:\program files\RenameRegister.css	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened for modification	\??\c:\program files\SkipClose.xls	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened for modification	\??\c:\program files\DisableUpdate.eprtx	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened for modification	\??\c:\program files\FindSuspend.xml	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
File opened for modification	\??\c:\program files\RedoInstall.xlsx	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1712	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
1712	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
4768	powershell.exe
4768	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1712	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
Token: SeDebugPrivilege	4768	powershell.exe
Token: SeBackupPrivilege	4260	vssvc.exe
Token: SeRestorePrivilege	4260	vssvc.exe
Token: SeAuditPrivilege	4260	vssvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 4768	1712	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe	91
PID 1712 wrote to memory of 4768	1712	5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe	91

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe
"C:\Users\Admin\AppData\Local\Temp\5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4768

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:6112

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\4vli1xx-readme.txt

Filesize
6KB

MD5
5e2112a1e31773fdf8adf6560e88e800

SHA1
639f908a5e73c400769a3bdbb5fc73e684b61a1a

SHA256
e17d76648adb0fd448d31b3831fdea85a766ee6f160cf2f7fbf83eb6dba460ec

SHA512
ffc2e67c8d52d5923ef1a9e16501034d8ce67720caafa52324752129e881ca2cb58825cdd5c53f855adfe0a0cafc02fe01807826019f5c6fd7d96d5d7757f9fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4olv2hsk.qvu.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/4768-0-0x00000201CD5A0000-0x00000201CD5C2000-memory.dmp

Filesize
136KB

Download
memory/4768-10-0x00007FFCCCE10000-0x00007FFCCD8D1000-memory.dmp

Filesize
10.8MB

Download
memory/4768-12-0x00000201CB4F0000-0x00000201CB500000-memory.dmp

Filesize
64KB

Download
memory/4768-11-0x00000201CB4F0000-0x00000201CB500000-memory.dmp

Filesize
64KB

Download
memory/4768-15-0x00007FFCCCE10000-0x00007FFCCD8D1000-memory.dmp

Filesize
10.8MB

Download