sodinokibi | f15a676fff5bbe1e42d153dd272961376c9348b0876842014f97d3640d5bf40a

General

Target

81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
Size

115KB
MD5

7e18b037a068c56417fb8e56aa7e49e8
SHA1

f6739569a24358c8c060d7131be70712f70f36e0
SHA256

81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed
SHA512

d6188e5536b6e0b5c49d572e35155d633c11fd30bc8d4bf4ea87fea7196ae2f67bca364a0afaeed8209e5d4b2be0b98d81c49293d3fed95c70c8388b8387899d
SSDEEP

1536:AkdeUcaK8Qz4PQIUnq5WMrAmyopACC9ICS4A0vh4NKwTNA28V5/Ogsck:mlnXEXyk7yvh4NKwTNF8V8v

Score

10^/10

sodinokibi ransomware

Malware Config

Extracted

Path

C:\Users\3bd23139wd-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome Massive Prints. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 3bd23139wd. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DDEE73DC44BDDFB2 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/DDEE73DC44BDDFB2 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 3BratXcZFWZvNrJ8WojbHfX2qo4LLKc7rtv+I6eMt778i4R5BU4vLkDsTNC1Osp/ u8AkPXOXGfK3EQq83H1ck8oWiZZG7B4N33Rae0R+8kbUIw8ohMG7UxBQax/o/yng eL4H5ERXQr7p/yufP1v6wQG8pZfiK719Kae5TuKYScpmXQMuBYm2/Qqbnqm9r28u QMyKoB+LjFBYKFKx7Rhmq5ytgRCWaD8JQtzW8KCYmPQNwRPJ1hUEhr+8DYtPeoFm Ye7+0RwqJdCMe+tUkXaZmO5K6yAVzB1XTaD/5jISYFoGVOSuI5J4DBGbVgHp6c8i +UFFnZSsH7Fn7E5FtwHLrZcT1OneunResmdx1KnN6oHp4BExAyT4quuOlVw6k1O4 9XeTylpjqJdPLDnxm2JmUMsP1Uo81vT29dlkFoj3iC1wGjzrBJ+ZBkn88Cngmy1y gBbL9YP+ji79J6zXbG308QwXEwepp99PG72S0BhIFUXq1HzX5ziKcyrwwWVYhZmw oV2t7xPFz8G+RSqhHlWycetBS7tTjXYj1HvR8Q/A4syLxX48VYelrgeCLua9tKhY 1SSiREPD8q5xjgf4y7AwZaJJLAGAlBToKKJQpDWH/+9DiGzjEPIPTT+ajCD7w5o4 g0zx5zDk9gEy0kdufIbNLCEx3mFt05xhIQs0GsuqOksR1E4MJUxZ969qE0BSDQqL XX7AXLgg76TyhQBfXYgbPmXOkk1hRqvm+I4cOOOs8lcnQAUMBgbUYEiyD4ZRpGpi GYVpbEEybECn2e+ULf/g2DFJax/Xkii+oYuza7VO23OAPptpnypn0ggSETZzct8U vf1h/kVkGnqVzfEYCXUkRk/LeMFQn9eFdYOl8o/uC7FJ1v7WvohwVstbnwnagAR0 zUslmLMI6sUkKLG5goOo+6YQTfIKJG437VRuBkrvLWXermKaFguFqBoO5W5iC0Nh l/OQyfF2KghbQQnHaim4MGqKVznlW8Ymr6uV3pUakZRm2yM5oWY02ggQtLN2wv29 owFKqEsYjQRgQSbhYI1l3CSLCb59UOvvxkBgxH1nwsOstc300woV3mEHEkAimoQr DmDBK/GwmGexRi0hY1q7zMwUJ48rqdSznG81R0od+Tzj5ludXvVk0eqWQ4Eg5CpQ NpRWfQS2oe8VkycrQL0GjTc0l6H1GnDgZnQ0dkve5YKi88mWlf34gg1GpGk49gNC XME0yxjizb8J+yQYvqjvtualHXcYNyqFZjDrTnc2Y7Bs+YzZIrvAXrrWiExoVugi MdxqKsyrGlCeqDMnIXcYIcXPY0t7/0SJHICiIC14wjbtowg+OZ7P6Xb2wIUDkqWb 5v7QVskhY8uShbwPZHVLYa7ydBx0K5mB199h8z1ywZpmoLbXWXshGw== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DDEE73DC44BDDFB2

http://decryptor.cc/DDEE73DC44BDDFB2

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe

description	ioc	process
File opened (read-only)	\??\J:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\K:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\Z:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\N:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\A:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\I:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\X:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\Y:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\D:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\Q:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\S:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\T:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\W:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\M:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\O:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\R:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\E:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\F:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\G:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\H:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\U:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\V:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\B:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\L:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\P:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8mt.bmp"	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe

Drops file in Program Files directory 38 IoCs

Processes:

81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe

description	ioc	process
File opened for modification	\??\c:\program files\InvokeJoin.xltm	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\StartInvoke.TTS	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\CheckpointInvoke.vssm	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\SearchBlock.ex_	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\UnblockEdit.DVR-MS	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\3bd23139wd-readme.txt	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\SendStop.zip	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\AddConvertTo.mid	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\AssertResume.odt	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\BackupPublish.mp4v	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\DisableUndo.mp4	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\ExportUse.aifc	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\FormatRegister.dotm	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\RepairUnblock.iso	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\LockUnlock.xht	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\ResetWait.vdx	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\SaveWrite.mpeg	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\SearchImport.wps	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\WaitSelect.jtx	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\3bd23139wd-readme.txt	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\ConvertFromSuspend.txt	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\RestartUpdate.mov	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\UpdateResolve.tiff	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\3bd23139wd-readme.txt	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File created	\??\c:\program files\3bd23139wd-readme.txt	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\CompareSend.mht	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\OpenPush.vsdx	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\ShowSet.csv	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\SkipRepair.png	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\SyncCheckpoint.au	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\UnpublishUse.ods	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File created	\??\c:\program files (x86)\3bd23139wd-readme.txt	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\ApproveRemove.DVR-MS	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\ConvertFromExpand.avi	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\PushReset.fon	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\RemoveDisable.rtf	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\RepairSync.svg	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\UndoClose.snd	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe

description pid process

Token: SeTakeOwnershipPrivilege 932 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	932	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe

C:\Users\Admin\AppData\Local\Temp\81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
"C:\Users\Admin\AppData\Local\Temp\81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe"
1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\3bd23139wd-readme.txt

Filesize
6KB

MD5
da195241e43b89c869944b5ce6eff892

SHA1
176655b9fd13e239ab7ba1c59d3cb6a570475051

SHA256
f4fc66e1824d919fb48006610419b1eb8ffdfbe8429107ef62f298e6170aa373

SHA512
42142b708386b4be68a83957a58b47a266b769e536ba13d75646fc18d693db27e3020cb60bf261c92f37a1c704dc13b9a0e9a04014b43d0700b9f0f08b041aab

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads