sodinokibi | bef5e19dd521e73f355fecd74f9a174a75f6d61e8fc8e6e738f8e1444ef597ee

General

Target

7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
Size

282KB
MD5

1e7cc3701e8b0266529709e24cd2f6fa
SHA1

5efac9cd4bd5bc67d3898280046967a2cdc5e547
SHA256

7d5e6782e91871fd6fd5adbd61901443f5b5a18a7bffdf56426924a1c117c0ca
SHA512

4ffcce0f25d7b3fdde59c0e73a4416fc538af9b3ef96f43c15267a7bafad0df372cbcd21aa4f36f0632465fe61e28b9d65c4a2e7bf180affb5b0e4799ca72841
SSDEEP

6144:Lyjv5Cf5wXjj6O4QYmm2b2sqWI0wYF/Ie:mv5CfewQ82blqWIYAe

Score

10^/10

sodinokibi credential_access discovery ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\be8jl4u-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Hi there! We wish you to have a good day during these difficult times! We have to notify you that we have completed the downloading all sensitive data, including personal data about your clients, projects, databases, reports etc. Ask us - we will provide you with proofs. We will public all the data in case you refuse to pay. Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension be8jl4u. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). In your interests to contact with us ASAP. Otherwise all your valuable information will be published and sold. Believe us, it's gonna cause way more expenses, than the price we ask. [+] What guarantees? [+] It's just a business. We absolutely do not care about you and your deals, besides receiving advantages. If we do not make our work and obligations - no one will cooperate with us. This is not in our interests. To check the ability to return files, you must go to our website. There you can decrypt one file for free. This is our warranty. If you do not cooperate with our service - for us, it does not matter. But you lose your time and data, because we have a private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/06A63B3A7B795213 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/06A63B3A7B795213 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: XoszJwUc8sGgCguy1SZWHnry/LqyXgsGEjDm8y+MJbXhoQNJddrS4GqFSJ1cWUvW j69MLOwV2e3f7bDB8Hu7BTPjW94T+UH4g0pAjaxXR23ySyxenPKnNI5JDMkgKERl Tl6fthzRr6r7fzZyH/FBHBFIjYHczzHLz3YRNqXeFfcqtI1IOj2ORn2ga6OhadwO SAaktEDqdNuokfgd/4mdu5Lpk65ikwLCIa2+MgSjZHO26Z2IqL45tkc6fmyLVVFl tFMSX8IW9zX8C1WFpIHsTPgbbq4HwIGWcpccWBW2EEWPuGOPMzfDovvNEhJJ4dBg fx5m1aZc2KJRsQ9x/dbcgNwEHhWnVp4W3EIaZgVyUvie6SUvIFp5ix9oViibFm16 25BrNP9pInj6e0RP9w1o3lIoeiMoP8IoCmhsIfSPvSbLq3YeF0ScxnQaXM460fnF Rg75Fi+jR/cYPivvAFXMPB7KvwZn4rx9KCkBNZsTZzMihKakyWlk+NdnoQoA/ldH +UgLXeFczkAQkPGgtqBQTeIwHPR3Kyv7euG2l2C2zZsg53dKeTYEdbcUEGjAH4x8 ozcCF75bmWGyqfcLYWthqgrcY6Nnfus5zDLp9ZiHXKcWUVYin6rzCtEiVguGVjxR 6FTrcwqK+m8cVts8Wm+zpOOnSAj+pomKezp7DINJiQNe+O/ocZ8JaxPJi7WlBIAP HLqeTmn3B5EExoTTzNEiCLjiMjRmItTIR6ucpHXM7u9sHy3+e1lPDaEbSVmmQpqc zjZ2go29ZSA+SeDP+TCi6Rv899atZLtFwtUUazwcEqt7Z8ilUedQ8nn/OYBuKZbi W4BTn177Um6b+QRA7CbZyJSPZ9z76rbPhBVSXPEodfEEWNsLAtN+J/ETcjRyT9BF IV3ob8zJM1hPGAtAfd5qaaoDegIRYWHZYB5pOepSJr0hAirvoVebQJAFKL3UfbMA ONjyfy3TWc00eYbea3UGwRihkmkI4cdrkvWLF8jChxGFj1yG0L5sAwWR64vHWCgk DSIVFMamkxAQT38fu4GJwQz1PbB3Rg6+oR1Bv+bkvQ56N3LurVmmdP54S5K1qW8/ P8Ub9B7z9GVDANlpPwHJgDMiP97bWe7uGaiYQRqXbS/81LA8WMd5bT94uM7aIJ+Q xgBMvK5oKvuPlqXQyE1fKi/atWef+cYVoZtexE0ZD9tZ7leafbL3qPsQFO3tNzj6 y/y807umKZBLUsqF8p0yMjRt1TpL0A1Qa/iOmNKAw65fSXtyjB4TCpzfCOwkfLUb xgz8O8i9GpZkoxUPYzgFA/fPRQpVdXo+dAEbu3oHNSZaVObP5L39yXK1NPePWtva 0je6bCWLE2FMcJbeoE8I0CBE9Qcj8fhKeL8aXm9N ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! [+] Attention!!! [+] Also your private data was downloaded. We will publish it in case you will not get in touch with us asap.

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/06A63B3A7B795213

http://decoder.re/06A63B3A7B795213

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Sodinokibi family
sodinokibi
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\E:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\J:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\L:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\M:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\R:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\S:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\A:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\T:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\I:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\K:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\N:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\U:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\W:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\Y:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\G:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\Q:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\V:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\X:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\Z:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\D:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\H:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\P:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\F:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened (read-only)	\??\O:	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atde00eg.bmp"	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe

Drops file in Program Files directory 26 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\CompressAdd.xla	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\ExpandRevoke.txt	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\LimitUpdate.docx	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\StartConvert.inf	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\UninstallUndo.DVR	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\WaitAdd.bmp	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\WriteTrace.html	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\ConnectBlock.ADTS	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\ConvertUndo.wma	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\DismountMount.mpeg2	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\ExportOpen.php	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\MergeUninstall.xla	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\ResizePush.DVR	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\UninstallUnregister.xlsm	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File created	\??\c:\program files\be8jl4u-readme.txt	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\GroupStep.pptx	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\InvokeFind.vb	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\SwitchBackup.ADT	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\UseSync.ttf	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File created	\??\c:\program files (x86)\be8jl4u-readme.txt	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\CompressStep.ppt	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\EnterInitialize.jpeg	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\ResizeSave.vst	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\ResolveResume.jfif	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\SendConnect.mpp	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
File opened for modification	\??\c:\program files\TraceSync.mpeg	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
380	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
380	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
380	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
380	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	380	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
Token: SeTakeOwnershipPrivilege	380	7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
Token: SeBackupPrivilege	1776	vssvc.exe
Token: SeRestorePrivilege	1776	vssvc.exe
Token: SeAuditPrivilege	1776	vssvc.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
"C:\Users\Admin\AppData\Local\Temp\7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe"
1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:380

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:5052

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

2

T1555

Credentials from Web Browsers

1

T1555.003

Windows Credential Manager

1

T1555.004

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Browser Information Discovery

1

T1217

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\be8jl4u-readme.txt

Filesize
8KB

MD5
5552bb154be1d39d9ee1b129ddf0a263

SHA1
199f6fd314f41474d68aef73384f6f112b670799

SHA256
1636349615cb25dbda53bca9390a4be9d6ed10f9b67884a43d520ccf2c0ac83a

SHA512
4c096f56d09195ca69e2598e50b11f397844a4cbcbd96fa0890e17efb84047d45c8d5417af04983075e793230f5484048a77647eed3108372c63ab7f5823b882

Download Submit
memory/380-0-0x0000000000400000-0x0000000004748000-memory.dmp

Filesize
67.3MB

Download
memory/380-82-0x0000000000400000-0x0000000004748000-memory.dmp

Filesize
67.3MB

Download
memory/380-89-0x0000000000400000-0x0000000004748000-memory.dmp

Filesize
67.3MB

Download
memory/380-437-0x0000000000400000-0x0000000004748000-memory.dmp

Filesize
67.3MB

Download
memory/380-442-0x0000000000400000-0x0000000004748000-memory.dmp

Filesize
67.3MB

Download
memory/380-444-0x0000000000400000-0x0000000004748000-memory.dmp

Filesize
67.3MB

Download

Analysis

Sharing