sodinokibi | 2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e

General

Target

2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
Size

118KB
MD5

9c08dfc58885a9a7beca989ea5ee9108
SHA1

ce2f51348da7a19dbf0e79b64f9eb8e46f45efa3
SHA256

2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e
SHA512

34cf39e4976f264f31b3236cca87aeca04ebc447fe99b35bbb72dd126462eed78310954fcdebab48b1f3ad9eaf5efe22ad8405b12d80ddd357244138067a1ae2
SSDEEP

1536:pRGfmACfvCHeQ5EJRDKiMIfB6Ym5p/eyxICS4AxpoC3/0bZ2YySvKxBPyAU0DeWj:omRj6YaWm8/0bZCSvKDyhVv

Score

10^/10

sodinokibi credential_access discovery ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\ual2r25f-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension ual2r25f. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] Data leak [+] First of all we have uploaded more then 300 GB archived data from \\UDATA. Example of data: - Accounting - Finance - Personal Data - Banking data - Strategic sourcing - Management - Projects, plans - Immigrants info - Confidential files And more other... Our blog: http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/ Read what happens to those who do not pay. We are ready: - To provide you the evidence of stolen data - To give you universal decrypting tool for all encrypted files. - To delete all the stolen data. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/06F651B76F549E36 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/06F651B76F549E36 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: DPhn+SpwLJLW/oex3iwg6OowPaOwZK/mvBkFoIMSaalhix19T5gx4LJZNXzfJ+Vp arPi47mu7DseICCIFoPbDvwgj2mw7SHyY86E8DMohW8NsVJgW+US9BgMkAQG0wwh R7mesXTpZEcKn7nzsrVU2MtT/qWrEFagWZBOrMIqIqAPbmIKxB+rY+qhInPtvsBl CtT7KBDtuIPICqC8V7GT10wwxjvuhdJrOWNxtenADcxjShEmdMa0EpS4rARw2kV2 pRm5QD/sbnTlIHlDEG0W2u6m+8IPvOfACQv0WTRv2VMlI7j/mRx+2D7d89mgYnp4 4iONlgz1tS31ZrqvWatuV0vn86j06niX22okQvgsa08vGYXFRqyzNo5/0N7s1jet vdi/PIp+NJuMzAMPGGy5mbixy5rblv6au6+OTODUVOAcn2v6VGrtN/YEWcsNKnbh hfVYplyDyONdCz+RojG2hhPdBL/O6cpQWPP1IuOLHJeGEgeNSM4cTKBFW0fWaSS+ WbOC3w5D4Nhcy/B/h50+n5XY7D1CiM5jXArPazSqzW1qtxgnlZOWKlWzn/qVC8K2 iqV5hqhFAmNHuBU11uumW09R5BtgFPVDgtT9CHiiiv/1MHVo/GynbUWYmxtupEnx L8QxzqkPOvAwPuGEuKR0/MwdRc/8+Cg+TOD76k4q87L9qVAPS1Pc/zZCHIlk+RTL u+6GgoI55gvG8o3Sz/8UeeH5IhbXjIAZ4GGov6NVs4E8p04dcei4Tp4vobz+yvhc /at1ARNqtvyUpeOEyJdvZGQTpTrdZ88Yfg9y3pU0b90Ni8yiP7iznPq7zClpu391 L5rPbgHgy8jFgsX1qFHnEsoKOT0e+8N+lzoiIj5OPPJri1qdhMQ6riNLDVAJT7Hd ser9zDB3FeOZ9WMcgpKsgGYAtXgKe9wShEUaJzxfNE33SLJjTiQIHEZKeOBFmAAT bA2t26Cm9Q0Y8ONZLhtwPihyJJZ/rO2VJThLz3CfaQOS70tAhsXVyJpIJm6cC6mj EZFP/6NEeVqR/KnzbcqdhC9FT6RHhL+qNW9MhB0NSSlL80HJmvZethPZgMmbmUGG tAbDPhS3gejhEkuNxCIHN4HDBuQlIoLfgodqmE3K6xYGEB3f7HNi8y3l2d5ZNGAK qO0D0d+TO1bfS4LqmHXCPGIVIwp6eLZgktl1ZOBjar/S/+hgCvTM60Z7O8AGZUfY nctkz+ApzPZxRN6uLiAPSiDJ3bn55l1APGGexbvsTH3Bi2oRGRCOSYfo/UTmFPOm IznMljiL/B1GeTRBt3rSIDU2GSqG30Vsx6uHk/1CvrDItxcu71aZaTrRRCJ8dHTc DHH9ZEyolyUg+UU5IEmEZuOvZWbfByvntI1osQSoJfJ35kL3MQXGVfFl ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/06F651B76F549E36

http://decoder.re/06F651B76F549E36

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\P:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\V:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\G:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\U:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\Z:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\D:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\E:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\K:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\Q:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\B:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\M:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\S:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\W:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\J:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\Y:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\A:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\L:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\I:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\T:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\F:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\H:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\N:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\R:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\X:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x63971.bmp"	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\SaveApprove.mpg	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\PopCompress.aifc	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\PopRead.ini	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\UnblockResume.contact	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\UnlockSubmit.ttc	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\WaitJoin.avi	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\MountFormat.mhtml	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\SwitchSplit.mhtml	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\RevokeSubmit.pdf	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\ProtectSave.sql	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\RenameMeasure.eprtx	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\SyncSwitch.xls	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\ConfirmExport.jpg	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4508	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
4508	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
4508	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
4508	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4508	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
Token: SeTakeOwnershipPrivilege	4508	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
Token: SeBackupPrivilege	5108	vssvc.exe
Token: SeRestorePrivilege	5108	vssvc.exe
Token: SeAuditPrivilege	5108	vssvc.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
"C:\Users\Admin\AppData\Local\Temp\2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe"
1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4508

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1052

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

2

T1555

Credentials from Web Browsers

1

T1555.003

Windows Credential Manager

1

T1555.004

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Browser Information Discovery

1

T1217

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\ual2r25f-readme.txt

Filesize
8KB

MD5
59667b5004e3849137326ff01e41e2a3

SHA1
04765a85c07cd51588916db2904e0950e6a69bae

SHA256
953d9790ab0734b48d7ee9e046b19ecdbf1466cb70956b42bc83116b99cd7cff

SHA512
666fc364472afa1538df7e5dc5ce5eb66b1b1f5b2cdd85b9232faf3ce39a6e7bcd2feb4808fea592b01bbbe7757d2297bd512dd9f62e18c5bbd00177ecb97593

Download Submit

Analysis

Sharing