sodinokibi | e0f59603265d8e99b26a4fa1ba3cd3ab5184a9ae29334201cf65df827ac7019e

Analysis

max time kernel
31s
max time network
35s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-09-2024 17:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
Size

116KB
MD5

b86ad4241b01376b3924a380f6f4c934
SHA1

10682d08a18715a79ee23b58fdb6ee44c4e28c61
SHA256

14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708
SHA512

54fd19cfc37255e7ddf3456d1a2989558522cf58e5eee6ca916c19542921fe3ba4e7a431a35e0e1edbfc37c5651d392e7c3c54eb408754c0488021b16fdf92c9
SSDEEP

1536:aTZINbRh0SKws6KTUkmHlntMvfWhbpfCqeICS4AKvQIFlswOmZFS0cnwpIGmQwB:FRix3PWhNlOVFmw5q0cifmQ

Score

10^/10

sodinokibi discovery ransomware

Malware Config

Extracted

Path

C:\Users\062wu7hg09-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 062wu7hg09. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] WE ARE READY TO PUBLISH UR DATA TO PUBLIC ACCESS IF YOU NOT CONTACT US (USE TOR BROWSER TO VIEW) http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/125?s=7ee0235fc7f67403393ad971dea5809e [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/694BD48044843E06 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/694BD48044843E06 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: mpCyHP7jTZPu2OV/Eh24bcHNQyJKaamlMRGUL83tuXObQKX3NJaDFDwY/QXJxAWd VJGDGwDgWbAjgzMQWXKuy0pMnRUMams1Ag+vk+m39Yvle2RhXPJh28iO5c/qgX6h LIJJ9fYFC3NMVNYNtaqrGS9tarCQ69feaBvLYkO/8R1pR8yLg5gybz00AV1j07FK c/3tmWrPHrwMbBfZiU7GEIoJ9ngD0Qz+upUr/+6v5vLEm/Wl1LLVSdgY3XT9yUPN ZMaN76MKHKf/RoQPRbRC9nUJjN0w+I/BJ+NERJjMujzQkQG2FujPiBcsmmym/nwA XLx0kaQ9oK9CLy/32+doYNIfJXNPWwAah1MIHn2yfSOPxK6JtgB5Cl/skIiAG0f7 GmlVroqzsFdD8vF959WaIpNxdt937IMOaCGUfdCbQZs6EwqSHgPEv+fSVwA9MtVV iq4wDNN8nWiDoNqSHv3cBESWmOt6QdxiGJuVPHrZFERYpirE3KZjy5l0vyfK8jHM lfCWokauRJHnloUPaYhdxFlgA01UdZNOAuFKK24LaG8d8JvRCl8X/gEZ3fzkcMPv /QIzCIOUw491oa63LG3R41MOg+UvlbQre2qsg4bc2D3oVTK4eDqo3Cch9mRVn2EU cjC0pLE37NE/WbLOpnDrThsL/gPqcRav48Fh+Kieub/rAbsNyijjaVp3GiAsEp6M wbY1ipmidgFdySsj54kvdCZbTuvhA/m8b1IxhYb2Cii4Sdz0ACvce7WTg/AqMI0t A0oAZ+PcpD96TzcT8ImqDpsQPV5DsyS2NPpj8ryTFejWp4CqrdIiAc6xrVM3Muv3 00V9a9k0O5ez+x5MyhdYPm9AXGuArg4rXwE2iGmH9Um44OgV+2sgGkEcILynf/N5 EtwhXkoUZR4Tdk15BlDqQl6mMoidu6X1zKaTCZCz4dC7ra+ukcWvB2A8Ix/G1UGx u6RSZv0TaTXwHLg+yCjKdZ7gyn7lYoUOCAv76+MkKyphjU7KlIy9uvCMSudu29OY eS8cxLsnFA8bQ45quJrgv4BfH6qpuDh2ityf3esZ5zuLorTERiiRr3elGo1btn9e Zzx8mRNnUP3KlaVPCj5W4Xa6yVxtWtA+3aWiLSvSMshKrObSR7F8VSazyP5KVtwO iSNGjlRpXAW1r+PIbnvUj0Ov5WrOXiLIkHLzK85H/ux1BQNt6yRFlOvrWCtyJZYU 9SceFcPyg2y7z2h7lSlNBXB4Ab8l8x+xxnwpteC4aBADvqmkYH/KJq3KS4zk9HXf bTbZKi6HrI9zm/O+kOHbi/deu710DyWr2t4L8+u0hgoXWKxfERWS6N6RlW2cq5In XR7s1okIaRBuVA9W2TL0x/cAMBc6lTCKAlie/8j6GDqnsWBL2qN4pQ== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/694BD48044843E06

http://decryptor.cc/694BD48044843E06

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\M:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\R:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\S:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\A:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\E:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\T:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\F:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\G:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\P:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\U:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\Y:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\Z:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\B:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\I:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\Q:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\H:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\J:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\N:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\O:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\D:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\L:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\W:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\X:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\V:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\n1h5mq1112z.bmp"	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe

Drops file in Program Files directory 34 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\ResumeRepair.7z	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\UnblockNew.sql	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\EnterMerge.emf	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\ReceiveClear.tiff	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\ImportConvertFrom.mpeg3	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\ReadConfirm.vssx	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\RenameRevoke.mht	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\SelectSearch.m4a	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\UndoGroup.gif	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\062wu7hg09-readme.txt	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\CompareCompress.nfo	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\EnterPublish.rtf	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\ExitSuspend.xlt	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\HideRename.pptx	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\MeasureBlock.mov	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\MergeClose.kix	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\ClearMount.potx	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\CompleteConnect.edrwx	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\SubmitUnpublish.odp	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\062wu7hg09-readme.txt	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\062wu7hg09-readme.txt	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\OutUnprotect.3gp	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\StopResume.temp	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\CheckpointPop.eps	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\SetRequest.ps1xml	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File created	\??\c:\program files (x86)\062wu7hg09-readme.txt	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\AssertLock.ini	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\UnblockCompress.m4a	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\EnableLock.ADTS	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\StartCompare.vdx	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\SuspendDebug.htm	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\UnpublishExit.ADTS	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File created	\??\c:\program files\062wu7hg09-readme.txt	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\DisconnectApprove.iso	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1320	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
2948	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1320	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
Token: SeDebugPrivilege	2948	powershell.exe
Token: SeBackupPrivilege	2788	vssvc.exe
Token: SeRestorePrivilege	2788	vssvc.exe
Token: SeAuditPrivilege	2788	vssvc.exe
Token: SeTakeOwnershipPrivilege	1320	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 2948	1320	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe	29
PID 1320 wrote to memory of 2948	1320	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe	29
PID 1320 wrote to memory of 2948	1320	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe	29
PID 1320 wrote to memory of 2948	1320	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe	29

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
"C:\Users\Admin\AppData\Local\Temp\14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe"
1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2948

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2884

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\062wu7hg09-readme.txt

Filesize
7KB

MD5
52fc7b88d38a7023fe38722060c282f5

SHA1
c3d2e4857e7a088cfb72718a9dfba8732045b25e

SHA256
dbe1f3944246fff6ff3438178c48204a70d11befcff06f4e17a7370c66cb848c

SHA512
1d1e476644c7c6d22a4a9cd3940988d69c8639489c5371372d5aead72b47ac5db95acc50ab8023681e86ed6e246bd629b59c8c031313f41ef123b0fde4af2e7a

Download Submit
memory/2948-4-0x000007FEF666E000-0x000007FEF666F000-memory.dmp

Filesize
4KB

Download
memory/2948-5-0x000000001B330000-0x000000001B612000-memory.dmp

Filesize
2.9MB

Download
memory/2948-6-0x0000000002290000-0x0000000002298000-memory.dmp

Filesize
32KB

Download
memory/2948-7-0x000007FEF63B0000-0x000007FEF6D4D000-memory.dmp

Filesize
9.6MB

Download
memory/2948-8-0x000007FEF63B0000-0x000007FEF6D4D000-memory.dmp

Filesize
9.6MB

Download
memory/2948-9-0x000007FEF63B0000-0x000007FEF6D4D000-memory.dmp

Filesize
9.6MB

Download
memory/2948-10-0x000007FEF63B0000-0x000007FEF6D4D000-memory.dmp

Filesize
9.6MB

Download
memory/2948-11-0x000007FEF63B0000-0x000007FEF6D4D000-memory.dmp

Filesize
9.6MB

Download
memory/2948-12-0x000007FEF63B0000-0x000007FEF6D4D000-memory.dmp

Filesize
9.6MB

Download