sodinokibi | 2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e

General

Target

2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
Size

118KB
MD5

9c08dfc58885a9a7beca989ea5ee9108
SHA1

ce2f51348da7a19dbf0e79b64f9eb8e46f45efa3
SHA256

2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e
SHA512

34cf39e4976f264f31b3236cca87aeca04ebc447fe99b35bbb72dd126462eed78310954fcdebab48b1f3ad9eaf5efe22ad8405b12d80ddd357244138067a1ae2
SSDEEP

1536:pRGfmACfvCHeQ5EJRDKiMIfB6Ym5p/eyxICS4AxpoC3/0bZ2YySvKxBPyAU0DeWj:omRj6YaWm8/0bZCSvKDyhVv

Score

10^/10

sodinokibi credential_access discovery ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\exyo73y-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension exyo73y. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] Data leak [+] First of all we have uploaded more then 300 GB archived data from \\UDATA. Example of data: - Accounting - Finance - Personal Data - Banking data - Strategic sourcing - Management - Projects, plans - Immigrants info - Confidential files And more other... Our blog: http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/ Read what happens to those who do not pay. We are ready: - To provide you the evidence of stolen data - To give you universal decrypting tool for all encrypted files. - To delete all the stolen data. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BCB6F865E7FB4C7B 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/BCB6F865E7FB4C7B Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: HgO3o6JEN9HEg1v3vgyoTARpsbIx4ohr6wVZrpw5F36jQkdd9miz9jlzFpMcnRlb kVlFAqc7hQWqAYaBtQY20cJzUYsXF4kuku9bXJOq1dqE93ktT1BQvuYUZRQCn0x6 dI2A3NipTaTRM5CDJ8kgQHjuosezBjnSQN5X5hIU7kOGjKngD4aB1iahYpsxeyGa OEuodHKA+tTz0QMAqe4sN9yMZmixdAg5vVfUQTu+C9TEstFZCJALzpWedTdj+DqI tqFdgbx3gqDPX7YSfGZ98BY51lfE6Cg17aESvR0ovZRDH4CWICtVXjUhDOy0H6Jk 4IweXccc24Z/h4u6utKcurrkzDZLY0jPaMN0uejKgkds20RHDBUeUheDnI8Ztemz N46vT+5mcOb/IQT95gbyTTd1ZIBr9TxZ1WPuChwbol2fIE7aJjooDr9zJNN7il2Z cudg6thFqmOf8D7kW/011m8SVq97GGoHF3VMyLQx8vMrWCNXmc9HFFk1meaSNkUG KX531x+OhLQ39B+J5ZMevpJi4eSepy1hcyUNdtGWHr/g4c3bD/qifFy2rR3T1I+r aoiaJDCnasgMP25npfo7EpSIwKNLMRScvmir6eiDFe7Drq4EUM7MphMHDDXqPpjm FPyLG5evuQVo++DJvNlkXLQ6LmqBMlMlF8+srKo5lrv4lKqf+Wmz7jwa/BJM4YNC W/9/LiEtkCGaWNcdUzuv7WJ0KGMxS0+6fLu+Uwyb/vWZZpD2VAtRjM1jWm9HlJgF 9es06oWFLK4c/NlAkTCSDIOP1zp30oh9tH4vI7qIX+83WN9WKMwnMTAhqZHPL+vq zSfsgXK81HZbYWKQFPSls/S1mMBSs2snSDduZB66HSEyHRkMBr8ryKDv92wsUjNv hYtHj1J+OGLk9bRbeiwue/MekgeRLd59A/NaV1J1MGyDGPGeVoGAd59vU2Iz8539 eWDCeT+oB1Vk0X/2KDwiRweTjMva+3hryaLxanQs2IhLpDO5slocena4FbVtMcyU sVlKSTjO7m++l/DImWqrWEESxBMqml5MnG5x905L7dX6Nt3YbTuLumKqpD0NzFWc TpNz6Rc/4TZB0UDOCZeR+7rG6pHj9UDAViUwDFK9mLd92zigBSOE4jI6WdaSP2ub My1f0Y5VoaGyxMJzjHdxiW2sRxROQ5RlyEMOrEjP8bZRYMj+K85sTEZmPjlSnjSY ZlcDi1HJcLxEIkvFue/Efn1vQaRkPVT35NzrxB5LzATpY5v07RBeOVZYNpVzjdrw aQXW5L/FFjZA43067nOzkRcE4pn4noraemWnyV1VSsSg24CjfpCz1mbPiOAixFwT 9JnD7gREh09lzPjAthaaMqME0yG+G94FKhd/jDkyMAVuRxh8GKPG+Q== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BCB6F865E7FB4C7B

http://decoder.re/BCB6F865E7FB4C7B

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\A:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\B:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\G:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\M:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\S:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\Y:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\N:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\X:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\Z:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\H:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\K:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\T:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\V:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\D:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\E:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\I:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\J:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\Q:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\R:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\O:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\U:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\W:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\L:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\P:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dbma8ro9s.bmp"	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\RemoveOut.svgz	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\SelectShow.easmx	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\ImportDisable.mp2v	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\InstallReset.wma	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\RegisterExit.pub	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\ResumeBlock.jpg	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\ClearWait.dib	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\ConnectSend.dot	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\EditStart.xls	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\HideMount.M2V	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\UnblockWait.rar	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\SendRestart.AAC	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\ShowStop.pdf	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\DenyClose.ppsm	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\EnableMerge.vdw	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\InvokeSelect.wmf	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\ResizeUse.htm	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\NewReceive.otf	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\UninstallUpdate.htm	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2300	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
2300	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
2300	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
2300	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2300	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
Token: SeTakeOwnershipPrivilege	2300	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
Token: SeBackupPrivilege	2212	vssvc.exe
Token: SeRestorePrivilege	2212	vssvc.exe
Token: SeAuditPrivilege	2212	vssvc.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
"C:\Users\Admin\AppData\Local\Temp\2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe"
1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2300

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:4816

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

2

T1555

Credentials from Web Browsers

1

T1555.003

Windows Credential Manager

1

T1555.004

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Browser Information Discovery

1

T1217

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\exyo73y-readme.txt

Filesize
8KB

MD5
e229a11beb4972b4f64182c7c19edbe3

SHA1
5826b8849165620bf3c00ed5d6f4ec571422b4b1

SHA256
d1c9bb22703c4881ba1d1f0ef49fa67fd8c84e6ea781ae8080a3ff4aa7dd0fe0

SHA512
cf98ad5a68ba752f4aeda5501cc76883291d88affd19cc7cefbfc776ecb219fe049c1dfa34574c09ef291ab490c70e53839c92bb6e65f172839e5fa68c06ed75

Download Submit

Resubmissions

Analysis

Sharing