sodinokibi | bef5e19dd521e73f355fecd74f9a174a75f6d61e8fc8e6e738f8e1444ef597ee

General

Target

7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
Size

282KB
MD5

1e7cc3701e8b0266529709e24cd2f6fa
SHA1

5efac9cd4bd5bc67d3898280046967a2cdc5e547
SHA256

7d5e6782e91871fd6fd5adbd61901443f5b5a18a7bffdf56426924a1c117c0ca
SHA512

4ffcce0f25d7b3fdde59c0e73a4416fc538af9b3ef96f43c15267a7bafad0df372cbcd21aa4f36f0632465fe61e28b9d65c4a2e7bf180affb5b0e4799ca72841
SSDEEP

6144:Lyjv5Cf5wXjj6O4QYmm2b2sqWI0wYF/Ie:mv5CfewQ82blqWIYAe

Score

10^/10

sodinokibi credential_access discovery ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\r0585-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Hi there! We wish you to have a good day during these difficult times! We have to notify you that we have completed the downloading all sensitive data, including personal data about your clients, projects, databases, reports etc. Ask us - we will provide you with proofs. We will public all the data in case you refuse to pay. Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension r0585. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). In your interests to contact with us ASAP. Otherwise all your valuable information will be published and sold. Believe us, it's gonna cause way more expenses, than the price we ask. [+] What guarantees? [+] It's just a business. We absolutely do not care about you and your deals, besides receiving advantages. If we do not make our work and obligations - no one will cooperate with us. This is not in our interests. To check the ability to return files, you must go to our website. There you can decrypt one file for free. This is our warranty. If you do not cooperate with our service - for us, it does not matter. But you lose your time and data, because we have a private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1FA62D7B3336B464 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/1FA62D7B3336B464 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ojNjXx/XTcKWoq9/UC8d1LDI2BONnh1UAxriUPFX2uzyBdZ/+r9z14jW6D0ZlmHD d46/RmwPpAlyAUa5AAug8HOwx9gOlEOAzLS3X1f8tfA5GJHd4EYHPUj6IfyTRQdN aTQ2tctI586h9BBBW5JsrxFRSL5xUjDyohZYVwLuBCEIecYwhqV4JJ6Hduu8z9zv ErU7sGfBp/iZKptBhpoU0cDdtZ999hpu+TIKM7F7eWP8df0bzCSEZMbagbBO/m8N DuR+YM1qV+ayk6ya7rHktzTDrGhkNLef8TqF63vZGpFCfWn8dImHyvgzMm08QSEk fDxxSYCHFmVd7wu6hNAcZJyQvAdOId5XvcjW+lrLSMFrR4o01yBrTiMGUeWcyeNm MdYrrgwuBjoqbdySGfMFXe1As/lWpMDH5jwoI/KolXFtuuTVmIIR3ItQCqnfeDys XNaHkppaRyJka0kMX1LZjqguEVO4jm3ATk02dzXcs5mTH4PlcJnYSUNka7NrS+FB XI+RJJkF/xRE2yxEwz1DosGFIZql2bwB9KbpM1mFjhkvJ38F6lDYEBkrk4J2uINp 5znV63QraNodEy1yD3MMQl6tgg2SL/48rcib6aPO5gXqgKsaxafrneVJth8TBwry yAToBCEX9KBFVwrT1aiDKz13Qb7Kmwzee+5Iiri8wDDDHkys59gb8LjmWEgGkoyy RykmfflXZY8lZIIGN6AvmlkwqkOgnKzESpP08YFMgGnZ7PLgV4oZkZ3B4ihNCXWX vug+vxkEzcK4V14YztJo9gHYpI8TTID7WTQsPgjOI3n24OY+9XY81rrbn16AvC4s nnb5HB3a3WZhL22dSXV0josusneseJrjKL4wyncqxOIvxeeZJiN69Ct2V3zIvsU4 K8KGhzSf1bawdaV8J6ZCOCR4AW2q3vpf80TCXKa6Ab7fGZh1W3EkZ0Iu5flp4IZv zAV0y85Vqx/DG/Wq9ki1zm9fWRbWlhg30wFgV+CnppirMRCsVkkFPBb7fNmZOy8i v1Pt2AuPQ+JzkomdR8Uh2ge7sVtA37XiN7cc9/VgVgt1vea04XkAtC1enwITJNL5 K2NEWmkQBqIciPGoOdthtHbQrlPeS8xZcNkGvQFGOY+Gi3yONQw88sUFvrqQfHEl YHLkKPA68PYRXQX1ilUuhiprhNt9B2sI6YNnBQQvweTNSq8O+5O4gYBEGpEA2g0P ZghUa+eEc2v+DNoj62jdhcnlQO+yHCNDwkKC8PUhWoVDi0zHzJ4C/Jbw66FtRyKk 1/N0OAMQujYaJn7AHCD0I++wZiotzHHmwjVnf+fTkQ9+tdkQnOxvgMYmo5pH0WEZ 6U9getGc46BTWlabDcSdWTVUIY0= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! [+] Attention!!! [+] Also your private data was downloaded. We will publish it in case you will not get in touch with us asap.

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1FA62D7B3336B464

http://decoder.re/1FA62D7B3336B464

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Sodinokibi family
sodinokibi
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\J:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\N:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\O:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\V:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\B:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\I:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\K:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\M:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\W:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\X:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\F:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\Y:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\E:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\G:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\Q:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\R:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\S:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\T:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\U:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\Z:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\D:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\H:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\L:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\P:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pf6.bmp"	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\UndoDisable.jpe	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\r0585-readme.txt	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File created	\??\c:\program files\r0585-readme.txt	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\BlockPop.mhtml	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\JoinSuspend.fon	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\NewEnable.jfif	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\ShowSplit.3gpp	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\SuspendDebug.odp	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\r0585-readme.txt	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\ConnectUpdate.m1v	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\ConvertCompare.php	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\OutDisconnect.mpp	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\ProtectRevoke.html	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\PushClear.emf	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\MergeGroup.wmx	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\SyncNew.vsd	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\UndoSync.xltm	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\r0585-readme.txt	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\OpenWrite.vst	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\UnlockRead.wpl	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File created	\??\c:\program files (x86)\r0585-readme.txt	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\AddSuspend.midi	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\BlockRename.mov	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\CompressSplit.rtf	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\FormatAssert.ogg	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2104	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
2104	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	2104	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
Token: SeTakeOwnershipPrivilege	2104	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
Token: SeBackupPrivilege	2560	vssvc.exe
Token: SeRestorePrivilege	2560	vssvc.exe
Token: SeAuditPrivilege	2560	vssvc.exe
Token: SeBackupPrivilege	1644	vssvc.exe
Token: SeRestorePrivilege	1644	vssvc.exe
Token: SeAuditPrivilege	1644	vssvc.exe
Token: SeBackupPrivilege	2044	vssvc.exe
Token: SeRestorePrivilege	2044	vssvc.exe
Token: SeAuditPrivilege	2044	vssvc.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
"C:\Users\Admin\AppData\Local\Temp\7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe"
1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2104

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2896

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2560

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1644

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

2

T1555

Credentials from Web Browsers

1

T1555.003

Windows Credential Manager

1

T1555.004

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Browser Information Discovery

1

T1217

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\r0585-readme.txt

Filesize
8KB

MD5
43d71c5fc58fc7c9ec5e6eb58e8ddf80

SHA1
f7d1692c9188be7a0b467292dfd9c52e8e31ae25

SHA256
6fcb58297e213edc609a89765021ecbc670f697a4de9e1cee2f02ae26d412cc1

SHA512
8c1a12ce4ae896914124a2b829fd2e226ae617bf4c573679cf596413a63ad33d4186d8143517e9da8da3f92d7bbb2a581c23ee56bfc8f0d0e511a3f403907e5c

Download Submit
memory/2104-0-0x0000000000400000-0x0000000004748000-memory.dmp

Filesize
67.3MB

Download
memory/2104-3-0x0000000000400000-0x0000000004748000-memory.dmp

Filesize
67.3MB

Download
memory/2104-487-0x0000000000400000-0x0000000004748000-memory.dmp

Filesize
67.3MB

Download
memory/2104-492-0x0000000000400000-0x0000000004748000-memory.dmp

Filesize
67.3MB

Download

Analysis

Sharing