sodinokibi | 28cfcdbe185abf8176d62b11287495989424bac090b573ecc319162f814fc523

Analysis

max time kernel
135s
max time network
154s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 22:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

run_revil.bat
Size

120B
MD5

0d0877a920cc13d77e89e72fd098d238
SHA1

3af65d1f0ff34ce90c289b1201a489575dd225e4
SHA256

41e9c846ad4099da47e7baa5ebfd51bc53a10716cd00130d843bb33e53440120
SHA512

b189fc8d21678926b7d79cdeb0ec44a63519cd7a7c85ce659b78ff7d2f526e2e92a2b308cf791c331cdc5cd5ed1d0fb482996a9587c3ee8c3741307dd9b4b572

Score

10^/10

sodinokibi discovery persistence ransomware

Malware Config

Extracted

Path

C:\Users\s102e1i-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension s102e1i. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/30CE13B6D81D3151 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/30CE13B6D81D3151 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 4KBTjkDOU6gIdkUbmij5ivGOw2TEwFKWGScTYuzC9OKlqNZ80iKG4i309ndEkvwC Imcn1PMukSQNVZz1DfvMrfEYq/LlYPzR0AaUQc867BiTq48kCi2CONADvmtaSX3S OggaUoTukZrMWio+Lj68eldfas/DI9owRJGtu83zUA/plAaySOI7nKUX1iVwn8g0 eHTBcAdZ9+wRGikVIMGMeEj6YBZKKkvj88GbZrFhgYvpFwFan8S07C5pVZunT3De N01Mn1gSHle4MNgvHo3uF6h6MWnM8BXzrHJLHpqcF2cy82ZDoOWMZ621Ebj/ZU9+ SOnq82LQsPI3NvvPUdrysYtPd8u7ycbNPaghb3Zp4TQU6ngr74foT2RXQjYY652q /BDfxX2P3jR3DJgGom+7gGuESOIfg0EqHvdoKerqL30Vk+OUw9XXfVEs1PZNybwF aEngR6TKyyNm3pH3ZGi4eVMsnc1kAV7JnKeChsNZbNRIkjKuYzdsIGESeuRL34qd E6ig6SGy0J8LiLiXL5LZqalRO9R6RWtEXd/lbvC3JfklrbxKH10vGNL3xAb/cZXK Grrm1srG1eWvXVGKXefyrhepD22pLipQho8aO1Zb1+oHYxvDcXWZ0G8Kdu3tX0qC /A5dj+mKKDNEj0I73V5erAZed7DokP+9tdE0kG5lgBQfzogzQ2N/VFJvA0+OX226 fdheJu90UlFvogXtjR9C8y+dsWwj3EEiNsyaHnEVX1mmYDU++BszBV9iCGg2kq9L Mfn+aJ/y26qdXrbb+uKCYMn52T4wvWIGe/iUIdRVyidNchtGIWWOeLdwqLZDiIu0 Bj9NAmcu4+asH0zGGUWG/lbwRg+G2aFVHxPl+/7+pd7AadsUk1BRH5XFUz4p8HgF wFoFEJor8zu4ZpVXsbRxXBFGhJao2m7Bo7mY2CG6RZ4yH84iEzuO1s4bul6+A3yf iZXwvMVZJXHKfer2BDU3p64w1B5RaO17uWNqVdbhZHwHLTBVUhZZ7MzyEXKFtlyw /CoV3j753pM45P/dWnakejiNIzFSyaMoaNyJYmoqt44pXjHq8Sj+df6dnBw6+OxJ CL7IOdPOqq+hPEwUXTxqaG5jzQO7MNM2TGEOz1AYEoTAd3Z/FcD1FsvYlbvsDj4h lqZS2it4mHWWRVylzMC5Q/LGFOJ/Yl4FJ0i9bAy+bJQSp1hFNF5JxxxkPh35wKn+ iVLbaAFIAB0NUBsabfzXi5j0k9n/ikl6H9xi36xqvFJQd5VHntb1l97tnOi9FGl+ Qjl0MhzTT06KQIKn7rOFMArd1BhGFxhWAit7yE4hZWBc3ilnYlCvqHG2TEnL4hZF 9E9nZRJqLt/ouYZFoAZFIKbo766OUIqXpJFHuIaPlXVU4w== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/30CE13B6D81D3151

http://decoder.re/30CE13B6D81D3151

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Sodinokibi family
sodinokibi

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\i1neMACrFU = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe"	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened (read-only)	\??\O:	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened (read-only)	\??\P:	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened (read-only)	\??\Z:	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened (read-only)	\??\E:	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened (read-only)	\??\G:	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened (read-only)	\??\H:	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened (read-only)	\??\T:	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened (read-only)	\??\U:	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened (read-only)	\??\X:	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened (read-only)	\??\L:	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened (read-only)	\??\M:	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened (read-only)	\??\R:	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened (read-only)	\??\Q:	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened (read-only)	\??\W:	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened (read-only)	\??\D:	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened (read-only)	\??\F:	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened (read-only)	\??\B:	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened (read-only)	\??\I:	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened (read-only)	\??\N:	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened (read-only)	\??\V:	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened (read-only)	\??\Y:	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened (read-only)	\??\A:	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened (read-only)	\??\K:	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened (read-only)	\??\S:	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1ox.bmp"	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe

Drops file in Program Files directory 37 IoCs

description	ioc	Process
File created	\??\c:\program files (x86)\s102e1i-readme.txt	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened for modification	\??\c:\program files\ConnectReset.mht	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened for modification	\??\c:\program files\FormatDisable.ADTS	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened for modification	\??\c:\program files\GrantEdit.3gpp	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened for modification	\??\c:\program files\LockWatch.xla	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened for modification	\??\c:\program files\ReadWait.jfif	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened for modification	\??\c:\program files\UnblockTrace.mpg	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened for modification	\??\c:\program files\CompareOut.MTS	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened for modification	\??\c:\program files\PublishSuspend.rmi	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened for modification	\??\c:\program files\ResetSync.mpg	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened for modification	\??\c:\program files\TestInvoke.asf	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened for modification	\??\c:\program files\UseFormat.dotx	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened for modification	\??\c:\program files\MeasureFormat.DVR	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened for modification	\??\c:\program files\ReadExit.php	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\s102e1i-readme.txt	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened for modification	\??\c:\program files\SearchReceive.mhtml	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\s102e1i-readme.txt	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened for modification	\??\c:\program files\DisconnectWait.vstx	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened for modification	\??\c:\program files\HideSubmit.xltx	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened for modification	\??\c:\program files\BackupBlock.potm	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened for modification	\??\c:\program files\GrantConnect.odt	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened for modification	\??\c:\program files\InvokeUnblock.csv	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened for modification	\??\c:\program files\RemoveConvert.vsw	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened for modification	\??\c:\program files\ResumeImport.jpeg	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened for modification	\??\c:\program files\TraceCheckpoint.vsw	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File created	\??\c:\program files\s102e1i-readme.txt	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened for modification	\??\c:\program files\CompareCompress.wpl	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened for modification	\??\c:\program files\GrantFind.crw	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened for modification	\??\c:\program files\GroupTest.mpg	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened for modification	\??\c:\program files\ImportBackup.ini	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened for modification	\??\c:\program files\TraceEnter.fon	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened for modification	\??\c:\program files\UnregisterDisconnect.wmx	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\s102e1i-readme.txt	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened for modification	\??\c:\program files\CheckpointHide.tiff	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened for modification	\??\c:\program files\ConfirmDebug.xlt	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened for modification	\??\c:\program files\RestoreReset.sql	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
File opened for modification	\??\c:\program files\UninstallDisable.snd	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2604	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2604	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
2604	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2604	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
Token: SeTakeOwnershipPrivilege	2604	6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
Token: SeBackupPrivilege	1128	vssvc.exe
Token: SeRestorePrivilege	1128	vssvc.exe
Token: SeAuditPrivilege	1128	vssvc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2604	2060	cmd.exe	31
PID 2060 wrote to memory of 2604	2060	cmd.exe	31
PID 2060 wrote to memory of 2604	2060	cmd.exe	31
PID 2060 wrote to memory of 2604	2060	cmd.exe	31

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\run_revil.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Users\Admin\AppData\Local\Temp\6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
  C:\Users\Admin\AppData\Local\Temp\6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe -smode
  2⤵
  - Adds Run key to start application
  - Enumerates connected drives
  - Sets desktop wallpaper using registry
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2604

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1460

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\s102e1i-readme.txt

Filesize
6KB

MD5
e888722aa508ca0729b1c4a7e86381c5

SHA1
f8561a348853a2bc83c3dcc4edbe40efcbf5e263

SHA256
645e100eb22d5bd5241d83100cf3656a3834c7a0abcc344e64a1337a6b5af6ac

SHA512
38d87d8c2f8a07e1145372a19e16806b322f1ac18b29c99e30fb3c21f039b0cea90ddc52f2174f201e0c2915656e93fbb53f8d4b4a9ac5a997735ca92e60c183

Download Submit