sodinokibi | fbeb086471d10f63943f5e7b4812ed274d1b25a78f23899f1cd8c3d9e612d4af

General

Target

mrt.exe
Size

117KB
MD5

eb27b1f8be971d6dd9ff8a41f6075995
SHA1

07a610e3da08d7be94c849d75b2672935610a919
SHA256

f5761b03f6541c1e407eed46f02c32f24adbc1e75682b1093e7e08684df31ac6
SHA512

f24c9699be2d8ae3cca9b839224ea5f88b26f9102be16492cb759449a749a3df5d4a810e9b7eb36947629e0238fea5019d985a5220a3c677f301f7877adaf737
SSDEEP

3072:6h/v/aqIQhwIgM4spJgFzCVeWkZlS69se:o/vf9hZgMFpeFWVeW+p

Score

10^/10

sodinokibi discovery ransomware

Malware Config

Extracted

Path

C:\Users\6w898as-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome Dear MARTIN ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 6w898as. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] Downloaded your data! Public information! [+] We downloaded 260Gb of your information. If you don't pay, we publish full archive here: http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/170?s=9e10e7edc84e0c11efa28c245cca0f4c [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/284CA2684B8B5A77 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/284CA2684B8B5A77 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: dYjpWxamfgk+klH+Q98ORAPmvg4QK7VxU77sm3Pg21u/Jvx4QiEpzDQ42I24XPRN +Y71OdWqMuiwZVWcMQPcZgWC9+qIwI6QKouZoML7TUkS2SQhzSgK+aw5NC3xZGpg 8yiGGPQGoDmv2NEwshp+Ju2VxB/aZXoWB/jbgxpFSTvl63SZy0wA6vAqfnpOGVI2 DSVh9umLJ92GIr2y8/faQ/EUQlB6x7IS6dRhe2pUUQq4rXdW2lB7yCVY7L1yJlnK fwQ6SRIE6370IQNA2vM5mnoiSdi3f8dXFbB26RYsNTLUI0DoLimmi5WHFFUriI9s RTE6Ii3SsclKgOV5yNjfpkHxmzd4USeJfZo2a0t94sVg+kOOFaqbF3aBfpVf6G5o QeaPaFC0SqmZoFc/B5ZTJfFckGj4R5dxdCmz5A/bgJ0AwyGX2RdaPH8J+5tVYkzS ekUZLfS1SzqCLgD4SXz19VdALn8vOLWNak8BgHMk0xOJdigmg6ysP7DwT7ln8+Dd pCEgLWvK3HLqdFc74LgVLy+nbJYdqGzkWD/WiprhGnqopBwkifT6jfDz0dM5+Ut8 O+rsw89CS6N9wklzeL0t+oWVTYRBuvUWJmn/99T7uLvJmOIlTsigji4dJJhxfKUs 2oDC73uIw2CufQZ1/++AZn4Oxab3GluFhSr5QiZBWXFfKAEnw/nCGHEmJqxniI/Z Rvo8tIGoUlwjEetVjW4PtbYv9U5VNOweWgKWQzIZ2wQ4CUD1h40+kkRvVKAp7xkj lYFNcP99WewulcfnnshKDq5ZdKbzyn9/d7AwIc9kW0MwHyuQX2MNKGSs4lKHuQdv vYEIlOz9BzPM3aQhoMBcfYCDqkjsGnIfw2GVXt6oiwUFK37MtUjk600/gWsiYdVk WS02Oh+L+yTGqAFaYo8G0dbX753e/WtUaPQx8uVfcJ0C6f9H2V3i+e5OQqWRHTI9 lpSkGO4O2r3TKzgjnsb3Ur7hsrAQWxe8Ya3cbfp8dKyH4jfDX4lnax306VL74JgL vV2Nf3A6nSH02sYhPNF4qm1qvV0H7g/wFwuricMijREl5m4eWpTy1PHnGawuCRyS SOGbGdcdvru9zZxHzF2Yr0am/C8ygRIA+/ZMEfVcwLneXMNJSYW31hlbuyGC6uxn wtuO5L6+EnE24VWpICD3EFd+JtBD/PegT3eW/cH9z/IWdZcmOkSLANNwE+7NAUp0 Twl0Z37iEUKHEWy8jcocapCaR5QuOv8t0Ga7CGQhNGRMgySxx2IhmOHMiVW/2xwJ oFN/Zqe6pcFuXFhiuHOXc9Z5PpisEjXlYJf60rclitJC5RvHyeNlhEep2lWXQZ1s Z9DdLom9olO/kvt+qK0qdV71cCNgNFQwvtHxYeKGh3bAEI0vRt+F6w== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/284CA2684B8B5A77

http://decryptor.cc/284CA2684B8B5A77

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Sodinokibi family
sodinokibi

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	mrt.exe
File opened (read-only)	\??\J:	mrt.exe
File opened (read-only)	\??\T:	mrt.exe
File opened (read-only)	\??\X:	mrt.exe
File opened (read-only)	\??\V:	mrt.exe
File opened (read-only)	\??\A:	mrt.exe
File opened (read-only)	\??\K:	mrt.exe
File opened (read-only)	\??\N:	mrt.exe
File opened (read-only)	\??\R:	mrt.exe
File opened (read-only)	\??\S:	mrt.exe
File opened (read-only)	\??\F:	mrt.exe
File opened (read-only)	\??\H:	mrt.exe
File opened (read-only)	\??\P:	mrt.exe
File opened (read-only)	\??\U:	mrt.exe
File opened (read-only)	\??\W:	mrt.exe
File opened (read-only)	\??\Y:	mrt.exe
File opened (read-only)	\??\O:	mrt.exe
File opened (read-only)	\??\Q:	mrt.exe
File opened (read-only)	\??\Z:	mrt.exe
File opened (read-only)	\??\E:	mrt.exe
File opened (read-only)	\??\G:	mrt.exe
File opened (read-only)	\??\I:	mrt.exe
File opened (read-only)	\??\L:	mrt.exe
File opened (read-only)	\??\M:	mrt.exe
File opened (read-only)	\??\D:	mrt.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1ei.bmp"	mrt.exe

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\DisconnectPush.vssm	mrt.exe
File opened for modification	\??\c:\program files\NewRequest.js	mrt.exe
File opened for modification	\??\c:\program files\PingConnect.eprtx	mrt.exe
File opened for modification	\??\c:\program files\PopUndo.dot	mrt.exe
File opened for modification	\??\c:\program files\PublishResolve.mp4	mrt.exe
File created	\??\c:\program files\6w898as-readme.txt	mrt.exe
File created	\??\c:\program files (x86)\6w898as-readme.txt	mrt.exe
File opened for modification	\??\c:\program files\FormatRename.aif	mrt.exe
File opened for modification	\??\c:\program files\HideConvertTo.xlsm	mrt.exe
File opened for modification	\??\c:\program files\JoinCompare.vdw	mrt.exe
File opened for modification	\??\c:\program files\MountGroup.wmx	mrt.exe
File opened for modification	\??\c:\program files\UndoUnpublish.wmf	mrt.exe
File opened for modification	\??\c:\program files\MergeExport.temp	mrt.exe
File opened for modification	\??\c:\program files\RemoveSearch.ini	mrt.exe
File opened for modification	\??\c:\program files\ResetFormat.asf	mrt.exe
File opened for modification	\??\c:\program files\ResumeRestart.wmf	mrt.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrt.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4864	mrt.exe
4864	mrt.exe
4864	mrt.exe
4864	mrt.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4864	mrt.exe
Token: SeTakeOwnershipPrivilege	4864	mrt.exe
Token: SeBackupPrivilege	4884	vssvc.exe
Token: SeRestorePrivilege	4884	vssvc.exe
Token: SeAuditPrivilege	4884	vssvc.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\mrt.exe
"C:\Users\Admin\AppData\Local\Temp\mrt.exe"
1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4864

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:4408

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\6w898as-readme.txt

Filesize
7KB

MD5
440883e6dd20d48193e47b3f0b4c01d8

SHA1
850c5eff7daffdd8ab168ce3d2e4048f20d27b22

SHA256
41d7a44ff0675efde427f8b9c613863db6681deea10c22c7a8f3ca20c8656794

SHA512
5919cf62f040f24608973d06a40563428e40f37a3fa77c892ccad36f84106e358eed19bdeac8f24dfb5b3ece0c777a0da364d786f12cd07ffe012d75956ef137

Download Submit

Analysis

Sharing