sodinokibi | 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed

General

Target

81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
Size

115KB
MD5

7e18b037a068c56417fb8e56aa7e49e8
SHA1

f6739569a24358c8c060d7131be70712f70f36e0
SHA256

81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed
SHA512

d6188e5536b6e0b5c49d572e35155d633c11fd30bc8d4bf4ea87fea7196ae2f67bca364a0afaeed8209e5d4b2be0b98d81c49293d3fed95c70c8388b8387899d
SSDEEP

1536:AkdeUcaK8Qz4PQIUnq5WMrAmyopACC9ICS4A0vh4NKwTNA28V5/Ogsck:mlnXEXyk7yvh4NKwTNF8V8v

Score

10^/10

sodinokibi ransomware

Malware Config

Extracted

Path

C:\Users\2er64-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome Massive Prints. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 2er64. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FAC260F1451E1E82 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/FAC260F1451E1E82 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: Hx0yCKRxh9IXpnwYhXZc1ItSTeDA/t59ZItrSspVNYBOD5Djx9E32EWxQVe+kAIj RRe0PE31r8Fbx9ow6Tm8I72UYyiSaOjOJUGSYgAdfQuDGJwKMUhMd1e8kxVVkNTz sPnc/xu+nR7BnEx9y7oScNpH2oiGG9mIXrQGA2oGVKA6ZpygYjn6YCEomSDqSjaR esf9zyP9YFjCqU4B1CsXu3t2/lCmBbfWtoZWYO7bLHkb1IiIC76IUxsV/IyPDUPs GM5EZnSqhyVvaE0kpz+K6xuX1xhcFXqOyNoOYzPtPZP35MONvwvLO0vrNmVZWbVg WH3J6GGnwdlqdQTLNKvALbwyWUM7QmKa2NDWbgqdR8zLmGZpBil81KNrL8i3bgWa 1Cvg3h2K9V4gtb1zAEXCjTen4qI0bDuPlkKm73zCPEn0zZsHxGI600/JMcy74g0w 6WvuFDpUYPUIIznLJlZMxiejx53i/zdzfNnhxQen1Vvdq+2zWRoRpcfRk0MqAsCm zVKv+VpNPrezzlytcbpTSJAB50uSh+lxWYcVNWgWif+ErgMDHyGGT2+QHkWDA00d vV6wwDVPXsU6qV9CWOeQ58JpprS+wRsd7aDFCPkvgAiOdCOyLbhL5fmv2M96/+q1 THKAESWDRI4vDDHX9xmy23suEfyCHJTlo1H2EfftfDGDzvKouBn0yCwQDgFSzuxk Df4Mp5gTlu7wkFeb76W+p3kRMi6/VqjT4C0fVhcj/jcl8hLOSdUN8/WXlHQLT+Wu wiGXAQ3SCb91+K2MG0FJ9NK9qC6Ow7UCVBgPVCG1q5XjN2YXZQNnQKiqmq8Zyyil BF3NQ37RkLg/T/sM/gBkwL0mGm+p3xk5S8VwjPV0Sb3SwbiO88oz/JvLIsEJD3u5 m5Qpv3Iy9mqf3scKIodh3yt0hjYjzuAb8Db0vJMi9TTN5s2H2fGiXk/GFaXoxSEr JzFLYO/TARM+URyNrUttnzqAMl9O3WwlGTZwGQHo5+uhxqc9wIkfaAe3njypvN1o q8kvnTzIhoGXUr3nFp3G7F/+PJYmcPxHF/YvzUQejWWkQYrdQHvPSYCPkLArp/nv hF3oJJi+DlQT3WyiA3U/NTqB0pLjYMrdHPjCMR0b2XNEEYwmBxdf3BqiKaNui9NZ 3U9J3hYahk/Ka3LLXCU/2heO9EIOZu/hw+mGfM3z7DMWkAWyixwHqJBaj+qixX6a dhpSzYzOxP6CrB1Y4bdew6sCmPbxQNZUDjzZUt8f0Br+mIW2mksKo/OpRa0SGnAi Yqb0tDvPRIFat7dpiiWPTy8xehbfhQW1FWhMT1ufelyrqeghtdVaCOmJRl/Azl2L Gxs+GidrDRXfutqdFiv2M9pIJ0X0xZuQD0GSgdBafgwsSt8Q ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FAC260F1451E1E82

http://decryptor.cc/FAC260F1451E1E82

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\P:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\S:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\U:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\V:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\Y:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\Z:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\F:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\E:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\G:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\K:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\R:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\D:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\B:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\L:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\O:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\T:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\I:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\M:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\Q:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\W:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\A:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\H:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\J:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened (read-only)	\??\N:	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\18ps032s14q.bmp"	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\StopDisconnect.bmp	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\TraceSearch.WTV	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\ConvertFromConvert.3gpp	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\LockInvoke.M2V	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\SetStart.vb	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\StartCheckpoint.wm	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\SuspendStart.rar	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\LimitConvertFrom.mpeg	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\ReceiveUndo.cfg	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\ResizeGrant.cfg	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\ResolveRestart.nfo	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\SelectRead.wmv	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\EnableInitialize.potx	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\EnterDisconnect.mov	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\BlockOut.avi	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\ClearSet.aif	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\ConvertSearch.clr	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\SaveResolve.wm	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File opened for modification	\??\c:\program files\ShowEnable.TS	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File created	\??\c:\program files\2er64-readme.txt	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
File created	\??\c:\program files (x86)\2er64-readme.txt	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4432	81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe

C:\Users\Admin\AppData\Local\Temp\81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
"C:\Users\Admin\AppData\Local\Temp\81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe"
1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\2er64-readme.txt

Filesize
6KB

MD5
11304919c5790f4c27a481464b87a486

SHA1
793899dd2e9f2165c4d4162ba92b8779beafd156

SHA256
d643b8c17646190ce35e9b84b73bfce5f30a278d930fb5f6d943f4f6e74b70d2

SHA512
aadbb6eb31467e5ef64fb64224ce6cc9fd982b888c90a89d9c6a1d5abfb028ad519a8a03eb719f4f556dc94b54b43d099e35018fec025f0497821f099232c5ed

Download Submit

Analysis

Sharing