sodinokibi | 58e30f939535c1c2d65fbab197f4a6816931522b8513d8261154eb86f6e28579

Analysis

max time kernel
17s
max time network
18s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 13:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
Size

179KB
MD5

6a37119a7900d7c994cafb86166c3a78
SHA1

39e3d7eba4333f2fa4ff9a9a24ca8e84b2ad47cf
SHA256

0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50
SHA512

dc9df8dc9d52e477634f87fae065fac74440a0fdd8758a617fcf327b983476edc57e3ecd4b171206a36be76792a8f28662b65a5cf9f3cc61c32fdd28b391dc89
SSDEEP

3072:kEa2d8CfSXceqmPDu4lPZU/CZtpysa8ustqzhyb4lJklds:iCqlPDuGPG/abesYzgaJkld

Score

10^/10

sodinokibi discovery ransomware

Malware Config

Extracted

Path

C:\Users\54z17cg33-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome Alliotts. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 54z17cg33. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/328660EF4623E3CD 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/328660EF4623E3CD Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: Iqw9BqJhAVFLyAHquZTGL/vZzv71f54K5DtqDlRqGdSA6VJuRyq23MjRf0z4pDbU 82+wzvgXNhREfsyTXg1iKkWz5ScZZqkcUOgYpMLuteRtY93czmehmCJi9t6Sg2Om jAW7LPuUQEB3rBWcDkcCRYVIDyyxDUwRxP+8Va28BKIkhpkdr/HequShEuwjWco6 ssfQZNqkvQ82kqB0wKJuCVTYkKeemTAADNcEJU0AeUBlnWWHo2cloNhHC9q7PCWM QdfEgxVvNZnKF/H5pj9YzZZr8JqrlNgmjGo0RAYmw+E7YhwiucTG75/iJ19HTarG hEXyhw+Ma16LmxBaKU2Ns1uwYbo5W/8/EwC3j0QZTBjGBxkyOBHMNnpLQkeDQu1n 3II89tmMVAr1kENOehw5aOOhnqpKWgvHpaL/ijywJYHixTYhVCPL81IPf6J8afFK 1e5UL2c2/HiKAsP2StrfPTgWZMnZcUE07SojX3TIMyQ00YvBSxDF8Bsppm5pVF6N En7tPFyqPW95UuU3YDNAp0Z1uC2EDOiYwmfk7GW4j2flJ3Uo9/9HBGFqYYQOH7CN pOej+r22kkeym5FNlidG+9lqUVeVnBJYbsGvmnzn6m3XcjbFs78Slo6FH9F3BbEj XW4y+rhRRkd9tyQ7ul/tCluKGdRVO+9SZZNa+LIIPuPc65EZGo/Ko7685KjcMxMa EQ/foPwcd9boY/HRY8XF+TF3hs9Vr4k9BAwjCemD83y8uxPMLkejfH9bIXxxAqhg SybqjrOzimeQY1I9kp+UFfvCCgCErlQNoW0L4o1MJ1H9Z3EhsU4CMLV4G2K2R9Lq ftn61/1LmI7hvcrA2ryDCM1YwXwhtXlX9SvFKLwB71ZfVUMYdvZjOa0t3ulMtQWF SCRFXEjnWZrJRcf19jD4k+lLWkNDXuzspj6FjklIS3lYaAfi3+0ZLoXg8YmJEYAX ofdmQvxD7veF5VjxFu06Dcc+c9T5f/qr00eTKGyj9h9qda4xXIKmJoKzc0IRPzxg C3kx6BNZVUb1XcmnCJchAG2Ytj5dsrWyzJDWo5CMY+WXHn9e7AYi52bjHtj2QK11 RsLmxtxCYQl+FNvx9Bm3zbZYIe7sxH9gEZuPt1dckTsmAIWG1NOZoYv354U+U3v2 PQKPOQG5epTih5DHoyGaZuqtRYF+UlN4Udt4/Bi0AJ/EGxIFN9hVkvikmm1aQOrw w4u2Xx4qMsdjDFzoCt7WI7Qb Extension name: 54z17cg33 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/328660EF4623E3CD

http://decryptor.top/328660EF4623E3CD

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Sodinokibi family
sodinokibi

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened (read-only)	\??\B:	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened (read-only)	\??\H:	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened (read-only)	\??\O:	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened (read-only)	\??\Q:	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened (read-only)	\??\W:	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened (read-only)	\??\A:	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened (read-only)	\??\G:	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened (read-only)	\??\K:	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened (read-only)	\??\S:	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened (read-only)	\??\U:	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened (read-only)	\??\X:	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened (read-only)	\??\Y:	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened (read-only)	\??\E:	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened (read-only)	\??\I:	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened (read-only)	\??\R:	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened (read-only)	\??\T:	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened (read-only)	\??\P:	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened (read-only)	\??\V:	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened (read-only)	\??\D:	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened (read-only)	\??\F:	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened (read-only)	\??\J:	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened (read-only)	\??\L:	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened (read-only)	\??\M:	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened (read-only)	\??\N:	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\318u087613d4d.bmp"	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe

Drops file in Program Files directory 42 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\JoinRestart.wmv	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened for modification	\??\c:\program files\ReceiveRestore.rmi	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened for modification	\??\c:\program files\ResumeReceive.wmf	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened for modification	\??\c:\program files\ClearJoin.snd	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened for modification	\??\c:\program files\InitializeApprove.emz	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened for modification	\??\c:\program files\ConvertToSplit.snd	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened for modification	\??\c:\program files\InvokeExit.cfg	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened for modification	\??\c:\program files\PopMount.xla	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened for modification	\??\c:\program files\StartRename.mpeg	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened for modification	\??\c:\program files\BlockExpand.ogg	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened for modification	\??\c:\program files\ClearSkip.html	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened for modification	\??\c:\program files\ProtectJoin.tif	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened for modification	\??\c:\program files\WaitDismount.rle	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\54z17cg33-readme.txt	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened for modification	\??\c:\program files\CompleteWait.ttf	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened for modification	\??\c:\program files\ConnectAdd.midi	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened for modification	\??\c:\program files\OutMeasure.svgz	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened for modification	\??\c:\program files\PingSubmit.ttf	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened for modification	\??\c:\program files\ReceiveWatch.wav	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened for modification	\??\c:\program files\TraceBlock.mp4	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File created	\??\c:\program files (x86)\54z17cg33-readme.txt	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened for modification	\??\c:\program files\BlockRedo.ttf	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened for modification	\??\c:\program files\ImportSave.MTS	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened for modification	\??\c:\program files\RepairWait.xlt	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened for modification	\??\c:\program files\UnregisterPush.wmv	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened for modification	\??\c:\program files\UpdateSwitch.odt	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\54z17cg33-readme.txt	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened for modification	\??\c:\program files\ClearSend.contact	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened for modification	\??\c:\program files\ConnectRequest.iso	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\54z17cg33-readme.txt	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File created	\??\c:\program files\54z17cg33-readme.txt	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened for modification	\??\c:\program files\MoveSave.midi	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened for modification	\??\c:\program files\RestoreDisconnect.au3	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened for modification	\??\c:\program files\SetAdd.xla	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened for modification	\??\c:\program files\InvokeGroup.rmi	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened for modification	\??\c:\program files\OpenBlock.pptm	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened for modification	\??\c:\program files\GrantClear.M2V	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened for modification	\??\c:\program files\RepairEdit.wvx	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened for modification	\??\c:\program files\ResolveUnlock.wmf	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened for modification	\??\c:\program files\StepUse.crw	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened for modification	\??\c:\program files\CompressSearch.xlsx	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
File opened for modification	\??\c:\program files\DenyGroup.otf	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2724	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
2836	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2836	powershell.exe
Token: SeBackupPrivilege	2648	vssvc.exe
Token: SeRestorePrivilege	2648	vssvc.exe
Token: SeAuditPrivilege	2648	vssvc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2836	2724	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe	32
PID 2724 wrote to memory of 2836	2724	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe	32
PID 2724 wrote to memory of 2836	2724	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe	32
PID 2724 wrote to memory of 2836	2724	0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe	32

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe
"C:\Users\Admin\AppData\Local\Temp\0dab0428b414b0440288a12fbc20dab72339ef72ff5859e8c18d76dd8b169f50.exe"
1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2836

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2408

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\54z17cg33-readme.txt

Filesize
6KB

MD5
01fde81e85c7f68dd7112d46fd4adb94

SHA1
ac6eadcdbd59b4db446f288f7d8a95fbfabf5417

SHA256
d211997bb958b66b50fb866fc710addc59412bdb38616c4b8cbcf3ace059aa8f

SHA512
54ce8955d1ccbbb8b96bb78927804e450af3b0bcac1806543507a9648869b8de1f9fd0a13e1f6db22237400d5c5a77185f5077e275dd23b5d0d750d578d26fba

Download Submit
memory/2836-4-0x000007FEF589E000-0x000007FEF589F000-memory.dmp

Filesize
4KB

Download
memory/2836-5-0x000000001B700000-0x000000001B9E2000-memory.dmp

Filesize
2.9MB

Download
memory/2836-6-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download
memory/2836-7-0x000007FEF55E0000-0x000007FEF5F7D000-memory.dmp

Filesize
9.6MB

Download
memory/2836-8-0x000007FEF55E0000-0x000007FEF5F7D000-memory.dmp

Filesize
9.6MB

Download
memory/2836-9-0x000007FEF55E0000-0x000007FEF5F7D000-memory.dmp

Filesize
9.6MB

Download