sodinokibi | 514579601990c60bbd1df9ef2389f306f48cd639812b8a6bb4b5a1517c7374a9

General

Target

15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
Size

160KB
MD5

b572a0486274ee9c0ba816c1b91b87c7
SHA1

43a904323a8583203b307c622c71c8ca706c2462
SHA256

15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b
SHA512

77d4ee400ded4b4be92da0170e7d2c197c312089429a1650e2843d0ceb15402d14f7e4fc3c2e84f20eeaa24995f0814c2106a37fc4cc32de7dbb4c15b6c5a171
SSDEEP

3072:tp5SexkWi1Lbi4eTMlwDCnu/qjUt7ptQJS+s:HvGWwbnWJ/3tTQg

Score

10^/10

sodinokibi ransomware spyware stealer

Malware Config

Extracted

Path

C:\ProgramData\593zha2o1-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 593zha2o1. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9B42CCC45E5B8DB8 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/9B42CCC45E5B8DB8 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 1890F/C5EyQsubmnj4ZqJXMzBkVGgs2c8Q0TzMpEPR+zv3JTuPV1yTO3SsOknC0O OKaR7h5G2/hDvifnmQgGPzmPni86FnlNerlBCe6Manjr8z2ZARUpDGY13BvD8NAh y/6DPkK0hhL6eWBYSLC93t1vtXu4YOfkprsxskHoYAe8sEMtXkpLtM/F2Ogmsdru +jsc+toqkG4nEkwGCZ2EUSLLKm+H67hltVgQxBmYDNoV12Q6gGEBqk82goAn5Ksd +gjKRLO5emK/4iwfpuSOHsu/anOMr+EpeW3MhDzbGzCVTaLVtqUD6+GCI+hSJnYO xT83AeqQ672dMasCszxloVOjEhyjPYIuIBSqRhgU1bC6WLZBKXAaLZ6OSf+AWPp+ duBwaGmXxGui97fWxPWouI2D/sGoIWiNeWTxuLWeuFdLR7zoECfrddN3cf6I7q88 y0suP2Xnh9cEM9W1K3NgnDCbklBNvArm/EHbqiQqH64NRxAHwVREaItXF/ZBSBlj DDZk86mQ/gE473e3YYUdbGkxVjZenDumh+S9ZJZemmBp8IVP2eFcfkmk+FQmKE1F cBjuOReMnPONo3rCmdxm210BYNF9lFJXk9I1nQyL5VKcPizS+gpq8PbfNOYqDe7x fePqBIoAjS0D8x9G9+bJd8qsTkoxbWcGBeT7TJBZZSOy5TtClWYE/xHImZHHOn62 w2x01U+ZwhsjjD8PeOcrabX+/xmMxDsSuLaXhWC/bGfHql4Y4G+jfBq2cIvl28vk 61Eio3uz3RHtPpg5BfxuCyAn2Gl+xWyP1Fwo9GflIBxLALu0OzJZCvYr5DVA0Oev diSYpMrUuSxS+CjdVCFgvZGfz2CvdypbAjQphJBtIMuWH7/meyXOEEh/bED6tqsb fcx2vL1HVi8LW4hk+y3C9A5VZe0ZpUsfGoUpJM1Te4AaFpW/l0x/6XsL/DAlgbr9 1TLmzMg4CG+jR8t/p2JwHBUej36XAZsntl1o1Y3Gr2mnCj2NufsQPcovvq3MdM7p PAo2SkJkFYSWHKMsGxbGxtmHGU5Ho2R744mlb624drDdAyOB4YINMgsqFITbF2Gh rXyS6LeSULGTv9e2nxPjWJIjU9ICbEBYnKmQZBglPQNgrnbhcmVkJrpxzlEc5xdf wv+kjZ1tcPoRFNT1hGYLFsUh5ccq21m3roMVVsnesEGGQy7XYGhdumptKlLBRuNH Q4fLbQx5IwVEt48vfE4Yuvb4D9U= Extension name: 593zha2o1 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9B42CCC45E5B8DB8

http://decryptor.top/9B42CCC45E5B8DB8

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe

Drops startup file 2 IoCs

Processes:

15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe

description	ioc	process
File created	\??\c:\users\admin\appdata\roaming\microsoft\word\startup\593zha2o1-readme.txt	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File created	\??\c:\users\admin\appdata\roaming\microsoft\word\startup\5c4c3ad0.lock	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe

description	ioc	process
File opened (read-only)	\??\S:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\Z:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\B:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\H:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\I:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\M:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\X:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\A:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\G:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\O:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\P:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\L:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\R:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\K:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\Y:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\F:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\E:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\J:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\T:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\D:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\U:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\W:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\N:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\Q:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\V:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\m7n8694fe.bmp"	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe

Drops file in Program Files directory 33 IoCs

Processes:

15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe

description	ioc	process
File opened for modification	\??\c:\program files\AddSelect.xlsm	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\CompleteJoin.wps	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\MountInstall.mpg	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\ShowInitialize.vbs	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File created	\??\c:\program files (x86)\593zha2o1-readme.txt	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\ConnectClear.htm	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\FormatGrant.html	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\NewUse.mp4	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\CompressBackup.mp3	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\GrantUnblock.ps1xml	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\GroupRename.dib	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\ResetJoin.vsw	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\ExitFind.vstx	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\ReceiveRestore.vsdx	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\SearchStep.mpeg	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\MountConvert.edrwx	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\AssertImport.vstm	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\DisconnectMeasure.mp3	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\GetFind.eprtx	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File created	\??\c:\program files\593zha2o1-readme.txt	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\DisconnectProtect.dotm	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\FormatSend.reg	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\MergeSend.aifc	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\OutDisable.DVR-MS	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File created	\??\c:\program files\5c4c3ad0.lock	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\ResolveDisable.rar	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\SuspendDismount.eprtx	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\SuspendSplit.xhtml	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\DisableDeny.jpeg	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\CompleteRegister.mp2	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\ConvertFromSearch.kix	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\UndoUnprotect.clr	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File created	\??\c:\program files (x86)\5c4c3ad0.lock	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe

pid	process
4588	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
4588	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe

description	pid	process	target process
PID 4588 wrote to memory of 4352	4588	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe	cmd.exe
PID 4588 wrote to memory of 4352	4588	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe	cmd.exe
PID 4588 wrote to memory of 4352	4588	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
"C:\Users\Admin\AppData\Local\Temp\15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  PID:4352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\593zha2o1-readme.txt

Filesize
6KB

MD5
7629b670d20ffe834deea01f65618ae7

SHA1
c15e6731d1c263d26ae503437ed51b11de4fa951

SHA256
6cf1ef9edbcacee5b0c09e86942965567b3626709e84c666690e521084d3a80c

SHA512
9a40f28c86341388b214bd8731309e9dbd5df27ab694e3baf6ec0b1c6a42d7c4aaabb6d7a32a34d2adb3520bad371e9891006e383508f9a5c9804cf719a06c4f

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads