sodinokibi | 08c2d24cb9c632f9aa84254bb673c9df04d4ac23ee07e840794e9438b06e9bd2

General

Target

REvil_v2.06.exe
Size

121KB
MD5

46a40ec6d39b7530830f3047cdebaa1b
SHA1

a1540914b5ceb9e772ee5898e777f48e3cd57010
SHA256

08c2d24cb9c632f9aa84254bb673c9df04d4ac23ee07e840794e9438b06e9bd2
SHA512

64d3bd219e939100612242a35d36db8636a18eb962ce174284359178b6abb29c957bb1a0083015b948ff17c30e01ddd46c12824a83d0698b03372effeae0aa12
SSDEEP

1536:vjVXKif7kaCtHM7qpo6ZQDtFnNi+ti09or2LkLpLik8ICS4Ao3uZskecjrzgPujd:J1MZwlLk9Bm3uWqgu6M1njIXi1

Score

10^/10

sodinokibi credential_access discovery ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\n1jrkl-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension n1jrkl. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A3E3AE45FDACB846 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/A3E3AE45FDACB846 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: IN+RKAeDib4SlHE8XE9sLmFSYjxX68YfsM0Xof7GsmvS9ZYRmHYFlikhGq4j0IqA ZzalqEAUTH/dY2m6VxgYep0MB4bu6biQCX+0LeVD7i1hfX6mEZ7BtQnTIkJinbvk 9HC0y1ZK8RHXDqZw5hgXuSdrdl7pnjVM9Ls8gx0OSXNU9f0IuBUjPywWj+raZbQw lGE+IJf92jLI3NO9Q4xzm5gPE8SSdKQ9euF7cRAlHGxKSUlomWZQcTus1oh0vvRA zQV3r9EwiVpDGQTSdUKMEleG6xflA87qoMXSolzFwJ8v6BT4NnYWmZl70Duu1kwu L5jC7aSTfh9Q2tiWXw4vXIDa0TezE7MxA+ADV4YeWluCBTh/VOkQ74g2OQ1i+thr y4ks2BSV/N+hOcjBD/R0Mc9uZM/PF6w2Tp97lMm+ssgPbmKOd4TuTmXVmKPguLuv VRvSdtZarCk01VSbIiOs8rDcnzIwve4ofInr0CAdHQj0aDW7uWUKxC06c+0NR0V4 Uq8ekwHS6ferDhMfhjTVgZaV1Ligm3y4vSSkxzuhGXLlchGZ/V2fsWMEbu/SC6vA 6S7UQbTPrQnUsjXU87P7oA7ckOTpYZcSojsynnpcWS40yfNj0+ajOuTJGcHJ5C0g gb0jDy8mNd7zx9hI3oSFL7/KDN+QJ/+RFJxBPRTijjTb/SKb0/SRaM+7bik9iYNV 36BJJCi/pKIs3eWa/VqI7JgAenpKV2Q4k4BEk0k9t+mTaMaXfS3IyIkmWi+LRNu4 EdyUrRJz9wkmrFXqr7ErqxJXfgmBQmPOGYKzA8t2yajBJPirevjzhYc/mnkCFn0j EJOLR5NaxTXg7s8/+f1ZrNVf88F9Xj7KUwHA1rJWdBfoRI/1M8WUVkIFclqHOekv KqqQpO3n4+lXDA7v0sZd6ANMBGIumtZNxB8ShDsbrRDZ9L3N/VvyCeoYlULO/crF gfEFZK/WgHCTJiZi1qxyzVRW3xzHddn2giL3Rdx2YRGos6HLwRc0oY24RXpesavJ 6qxfoyTdH1nzrqHdmw8uNMqhKFHcQh7+paTLgD05xEmCBbNZLi+kVEBkMrOmr+U7 9ftVzIfKc80qp+t14//41a2PezqCv6+imtp3yRm45Yy91Fh2Dun7DslU7LOAg/D1 hI3PupZhQfUwnN4XVVfG25gNBeoyB4E13J5RKpvXJs881ijcLFhOnWe3sNQ8E93k 7mcCElTjgMfGEGamWiYraHFyutE0Wi/QfroWpiDbnNKedZhE47KWBKJjAherTByn UQf7HU50xIKKTpy+GDUgcS2qnlzOsRZ4nmhjP2WF0H3007TjqGKJjFpm/SJEDNcy geA3pFAupDwXIASaUp+Istgiz3fTEPV1pd9r7A== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A3E3AE45FDACB846

http://decoder.re/A3E3AE45FDACB846

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	REvil_v2.06.exe
File opened (read-only)	\??\X:	REvil_v2.06.exe
File opened (read-only)	\??\Z:	REvil_v2.06.exe
File opened (read-only)	\??\F:	REvil_v2.06.exe
File opened (read-only)	\??\E:	REvil_v2.06.exe
File opened (read-only)	\??\M:	REvil_v2.06.exe
File opened (read-only)	\??\O:	REvil_v2.06.exe
File opened (read-only)	\??\Q:	REvil_v2.06.exe
File opened (read-only)	\??\V:	REvil_v2.06.exe
File opened (read-only)	\??\W:	REvil_v2.06.exe
File opened (read-only)	\??\Y:	REvil_v2.06.exe
File opened (read-only)	\??\J:	REvil_v2.06.exe
File opened (read-only)	\??\L:	REvil_v2.06.exe
File opened (read-only)	\??\N:	REvil_v2.06.exe
File opened (read-only)	\??\S:	REvil_v2.06.exe
File opened (read-only)	\??\P:	REvil_v2.06.exe
File opened (read-only)	\??\D:	REvil_v2.06.exe
File opened (read-only)	\??\A:	REvil_v2.06.exe
File opened (read-only)	\??\B:	REvil_v2.06.exe
File opened (read-only)	\??\G:	REvil_v2.06.exe
File opened (read-only)	\??\K:	REvil_v2.06.exe
File opened (read-only)	\??\H:	REvil_v2.06.exe
File opened (read-only)	\??\I:	REvil_v2.06.exe
File opened (read-only)	\??\R:	REvil_v2.06.exe
File opened (read-only)	\??\U:	REvil_v2.06.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\PublishStep.rmi	REvil_v2.06.exe
File opened for modification	\??\c:\program files\SearchLock.asp	REvil_v2.06.exe
File opened for modification	\??\c:\program files\UnpublishRepair.midi	REvil_v2.06.exe
File opened for modification	\??\c:\program files\ExpandStop.emf	REvil_v2.06.exe
File opened for modification	\??\c:\program files\SendConvert.vsd	REvil_v2.06.exe
File opened for modification	\??\c:\program files\SwitchSearch.jpeg	REvil_v2.06.exe
File opened for modification	\??\c:\program files\UnblockWrite.xltx	REvil_v2.06.exe
File created	\??\c:\program files\n1jrkl-readme.txt	REvil_v2.06.exe
File created	\??\c:\program files (x86)\n1jrkl-readme.txt	REvil_v2.06.exe
File opened for modification	\??\c:\program files\InstallSearch.TS	REvil_v2.06.exe
File opened for modification	\??\c:\program files\SelectConvertTo.fon	REvil_v2.06.exe
File opened for modification	\??\c:\program files\UninstallEdit.mpg	REvil_v2.06.exe
File opened for modification	\??\c:\program files\WriteRevoke.aifc	REvil_v2.06.exe
File opened for modification	\??\c:\program files\UnpublishConvertTo.fon	REvil_v2.06.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REvil_v2.06.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4796	REvil_v2.06.exe
4796	REvil_v2.06.exe
4796	REvil_v2.06.exe
4796	REvil_v2.06.exe
4796	REvil_v2.06.exe
4796	REvil_v2.06.exe
4796	REvil_v2.06.exe
4796	REvil_v2.06.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4796	REvil_v2.06.exe
Token: SeTakeOwnershipPrivilege	4796	REvil_v2.06.exe
Token: SeBackupPrivilege	2540	vssvc.exe
Token: SeRestorePrivilege	2540	vssvc.exe
Token: SeAuditPrivilege	2540	vssvc.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\REvil_v2.06.exe
"C:\Users\Admin\AppData\Local\Temp\REvil_v2.06.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4796

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2992

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

2

T1555

Credentials from Web Browsers

1

T1555.003

Windows Credential Manager

1

T1555.004

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Browser Information Discovery

1

T1217

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\n1jrkl-readme.txt

Filesize
6KB

MD5
a79e6a983f1ffe488bf357ad867ffb41

SHA1
a4cd63ecfadc7cf2e3a0656e02bae709296be5ee

SHA256
28ff3f7380c74b88f680d4f5e474798c4b6ddafbfb75ada414efc8361906fec9

SHA512
fb5e357bd7cfd32bfd363b626d085f985e733aed688c82b8fdc036a6545ff1bf7d6b0835a9849b37d5abe86eb872a928fd0a7886de0c0aa8ad938f62e32a37b7

Download Submit

Resubmissions

Analysis

Sharing