sodinokibi | f442d0543f6df79be9fbaed90af2dedbcf2e4774561421763577b148a9ff8554

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-12-2024 15:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

v2.exe
Size

121KB
MD5

944ed18066724dc6ca3fb3d72e4b9bdf
SHA1

1a19c8793cd783a5bb89777f5bc09e580f97ce29
SHA256

74ce1be7fe32869dbbfe599d7992c306a7ee693eb517924135975daa64a3a92f
SHA512

a4d23cba68205350ae58920479cb52836f9c6dac20d1634993f3758a1e5866f40b0296226341958d1200e1fcd292b8138c41a9ed8911d7abeaa223a06bfe4ad3
SSDEEP

1536:vjVXKif7kaCtHM7qpo6ZQDtFnNi+ti09or2LkLpLik8ICS4Ao3uZs/WVEdz725sK:J1MZwlLk9Bm3uW/Wud2K36cn/wCY

Score

10^/10

sodinokibi credential_access discovery ransomware spyware stealer

Malware Config

Extracted

Path

C:\Recovery\4q0lh535n-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 4q0lh535n. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/93DE79065EDE37A1 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/93DE79065EDE37A1 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: n+hkNdfYOYISyjHrXg3MwVMfASLRqTcUZv+ukO8ROKkE9o5elRU6bekQFnQrAnph NfUitAvu0poF6zvPVZyaMHyLYk4g/KXIeCh2fGEofd7T791ouoQAje/BrEfcKrqE d0TPNA1G8W7gtKgKR5pci6vBdf1avFepcfij/U9spRMeQ3lw2ubZG2AtK22u1dMD yCmlGia2qP+OVB1kWx0FJgt/nwfX4V4SreEd+1GI24ArDfasG2mgUsFYT0AV63KB upn98oEa1e22l1swOJs55ti0Xv52/JkxYlsRfhZwUbLP3DqBX5ru0YSglP1zvzOh clD7V+GoAyo7ksgw3wyV4PNtN3LyenTp/jIEzKedFzYlu344Q0Yca82+4x4N2Oot sPcBylKFtnC9KmSCb7LAxBt7NDiWPJWD0GGF9chcFfriKNs+NYERMMT7WT4adDmw BssW/ERxnRlwd+xGAxpgYS7KhEnHHhFdqnuBIm6rA/RzDwN5m0RZxo7YsL6wufG8 9eWlV791to3/E7MmF0fnxONGsFOSAZpSig9iqen1cnIFJfSLG1eSPr0+d2fW5Vzc evf9eeu6+7KSEl8vbxzE8XcYVDhiHLOUHNqPRxDgdsK1q+SZcBt3sTU3/efZPPuG mUm6uv4Vzts01kIDoxKoCNFKM0EDQhQyHEBFDuZGHKiE1TNYBJow8eaoRzhu6L1l WFP9+v7P+mIrrjxO+RGIIyCovU0xZSt3SmGn9Ku6FK1D4IS/iPMrgV7U01BmQzKu AzoaN5qtfXCdnAWLEw0v6pW+vw8/tbMzwD0dm7Kzf9aQtRmupDgmfkF9YLLzpJsd 046e3JTIF4Vv9DUYqPChxG3a2azPElD9KenjyD1NPm9R+ZT3wWQ+3YV60xq9YBTm MzoTL94uwfeWQvXOBme2Fltq8OdT+JnPV8+oNJrSUPEFOk966M/3W90bXIHVY3/R xDonu7uOesHKeVAs665edhxB1rac+/pDvzLCuvBACQFyOmp7K+SyVq7ZDdIfiyhF Vdu7JH3l5q3Umg+AQn8rFsOL6b8SVcdMZJ68astzfopEb6Y/2zb4zESBMmAFivz9 2ViluU1knMZrXIqUAlvaZrOA0z6GNM0SFPyFKuGC2KPEEM47YcUxu7V870DKKHwa RFsbAbKOQ89rZ7tAHWRiQrmPyR9P9cLQQ/blm/+Tzs+M0vZNxUTy0lUbQdwH6ELl KL5KiuVU2qqjIzIpCm2JcJqOmyO6ufPoUx4l2YuqsBdGKtlQQwIzDurtOvVl9YtF JEw08ie3ljak8xKQ3yLyxqDViuRaE1RyVusCzXuwxmTAEQtApBE9ee0hpipIsN1e u3tqtuJeMxmgLmd3ig7BG2rGBLqlvbmHh8NpdXVXUnOGgA== ----------------------------------------------------------------------------------------- We will use the data gathered from your systems in future campaigns in 14 days !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/93DE79065EDE37A1

http://decoder.re/93DE79065EDE37A1

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Sodinokibi family
sodinokibi
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 1 IoCs

description	ioc	Process
File created	\??\c:\users\admin\appdata\roaming\microsoft\word\startup\4q0lh535n-readme.txt	v2.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	v2.exe
File opened (read-only)	\??\H:	v2.exe
File opened (read-only)	\??\I:	v2.exe
File opened (read-only)	\??\K:	v2.exe
File opened (read-only)	\??\M:	v2.exe
File opened (read-only)	\??\U:	v2.exe
File opened (read-only)	\??\V:	v2.exe
File opened (read-only)	\??\X:	v2.exe
File opened (read-only)	\??\Z:	v2.exe
File opened (read-only)	\??\E:	v2.exe
File opened (read-only)	\??\L:	v2.exe
File opened (read-only)	\??\S:	v2.exe
File opened (read-only)	\??\D:	v2.exe
File opened (read-only)	\??\B:	v2.exe
File opened (read-only)	\??\G:	v2.exe
File opened (read-only)	\??\N:	v2.exe
File opened (read-only)	\??\Q:	v2.exe
File opened (read-only)	\??\R:	v2.exe
File opened (read-only)	\??\T:	v2.exe
File opened (read-only)	\??\W:	v2.exe
File opened (read-only)	\??\J:	v2.exe
File opened (read-only)	\??\O:	v2.exe
File opened (read-only)	\??\P:	v2.exe
File opened (read-only)	\??\Y:	v2.exe
File opened (read-only)	\??\F:	v2.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\t37pwx2.bmp"	v2.exe

Drops file in Program Files directory 33 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\RemoveExpand.m1v	v2.exe
File opened for modification	\??\c:\program files\RemoveRegister.ogg	v2.exe
File opened for modification	\??\c:\program files\TestDisconnect.wps	v2.exe
File opened for modification	\??\c:\program files\UnregisterJoin.edrwx	v2.exe
File opened for modification	\??\c:\program files\RegisterExit.3gp2	v2.exe
File opened for modification	\??\c:\program files\MountAdd.tif	v2.exe
File opened for modification	\??\c:\program files\PopConvertTo.TS	v2.exe
File opened for modification	\??\c:\program files\SwitchConvertTo.3g2	v2.exe
File opened for modification	\??\c:\program files\DisconnectStop.css	v2.exe
File opened for modification	\??\c:\program files\ImportEdit.sql	v2.exe
File opened for modification	\??\c:\program files\RemoveFormat.jpg	v2.exe
File opened for modification	\??\c:\program files\StopConvertTo.docx	v2.exe
File opened for modification	\??\c:\program files\ExpandRead.mov	v2.exe
File opened for modification	\??\c:\program files\SubmitOpen.ram	v2.exe
File opened for modification	\??\c:\program files\ExpandRevoke.docx	v2.exe
File opened for modification	\??\c:\program files\NewConvertTo.xsl	v2.exe
File opened for modification	\??\c:\program files\UnprotectBlock.au	v2.exe
File created	\??\c:\program files (x86)\4q0lh535n-readme.txt	v2.exe
File opened for modification	\??\c:\program files\GroupSearch.M2TS	v2.exe
File opened for modification	\??\c:\program files\JoinInitialize.mhtml	v2.exe
File opened for modification	\??\c:\program files\RedoUnblock.dwg	v2.exe
File opened for modification	\??\c:\program files\ConvertInitialize.vbs	v2.exe
File opened for modification	\??\c:\program files\GrantMount.jfif	v2.exe
File opened for modification	\??\c:\program files\StepConfirm.mhtml	v2.exe
File opened for modification	\??\c:\program files\SyncRemove.cfg	v2.exe
File opened for modification	\??\c:\program files\DismountFormat.xltx	v2.exe
File opened for modification	\??\c:\program files\ConvertToResume.avi	v2.exe
File opened for modification	\??\c:\program files\DenyHide.inf	v2.exe
File opened for modification	\??\c:\program files\LockStart.ods	v2.exe
File opened for modification	\??\c:\program files\OutApprove.html	v2.exe
File opened for modification	\??\c:\program files\RequestMount.M2T	v2.exe
File opened for modification	\??\c:\program files\UpdateUse.M2TS	v2.exe
File created	\??\c:\program files\4q0lh535n-readme.txt	v2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v2.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5200	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4576	v2.exe
4576	v2.exe
4576	v2.exe
4576	v2.exe
4576	v2.exe
4576	v2.exe
4576	v2.exe
4576	v2.exe
4576	v2.exe
4576	v2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2760	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4576	v2.exe
Token: SeTakeOwnershipPrivilege	4576	v2.exe
Token: SeBackupPrivilege	3680	vssvc.exe
Token: SeRestorePrivilege	3680	vssvc.exe
Token: SeAuditPrivilege	3680	vssvc.exe

Suspicious use of SetWindowsHookEx 33 IoCs

pid	Process
2760	OpenWith.exe
2760	OpenWith.exe
2760	OpenWith.exe
2760	OpenWith.exe
2760	OpenWith.exe
2760	OpenWith.exe
2760	OpenWith.exe
2760	OpenWith.exe
2760	OpenWith.exe
2760	OpenWith.exe
2760	OpenWith.exe
2760	OpenWith.exe
2760	OpenWith.exe
2760	OpenWith.exe
2760	OpenWith.exe
2760	OpenWith.exe
2760	OpenWith.exe
2760	OpenWith.exe
2760	OpenWith.exe
2760	OpenWith.exe
2760	OpenWith.exe
2760	OpenWith.exe
2760	OpenWith.exe
2760	OpenWith.exe
2760	OpenWith.exe
2760	OpenWith.exe
2760	OpenWith.exe
2760	OpenWith.exe
2760	OpenWith.exe
2760	OpenWith.exe
2760	OpenWith.exe
2760	OpenWith.exe
2760	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 5200	2760	OpenWith.exe	110
PID 2760 wrote to memory of 5200	2760	OpenWith.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\v2.exe
"C:\Users\Admin\AppData\Local\Temp\v2.exe"
1⤵
- Drops startup file
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4576

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2716

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3680

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\MergeExit.M2V.4q0lh535n
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5200

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\4q0lh535n-readme.txt
1⤵
PID:1128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\4q0lh535n-readme.txt

Filesize
7KB

MD5
a3a93b226a531ebef002ccc22096b84d

SHA1
4946bb2ff453a66fba26409a0ef93671735e1760

SHA256
ad48b78d56e0de00347c0977da8f51429d427ef5460dc1755fb7051a2b2d4fb8

SHA512
8c2b4acb8da6ae456f7f27d1f60e558f6f3c2358d73835d6d3c4b567e9d9efb82e1fcab0ea93dd288f1d149d9f5613eb4b0e436c8dba9b18834bd057e75fbf9d

Download Submit
C:\Users\Admin\Desktop\MergeExit.M2V.4q0lh535n

Filesize
661KB

MD5
ecb9918dc82a16cc96003818914b91dc

SHA1
83a522e80a11f90060c3008f7fa9ce615d116b98

SHA256
bc573d7403377a6d6a9f6538b604bca8a0f6c5046ec1287c4117bb959241e96a

SHA512
c254def55a733cc5681fe16fe5118ba60dd963d0d9998f14586bb4f388094333cc1883d5d59f6b7cc9b83ebb09cdba2bb626a90a5bd1d5840c75729900ae4fcf

Download Submit