Resubmissions
03/02/2025, 21:57
250203-1t5hmsvmat1003/02/2025, 04:37
250203-e896saslgn1031/01/2025, 18:35
250131-w8gmxatmc110Analysis
- max time kernel
726s - max time network
541s - platform
windows10-ltsc 2021_x64 - resource
win10ltsc2021-20250128-en - resource tags
- submitted
03/02/2025, 04:37
General
- Target bazaar.2020.02/HEUR-Trojan-Ransom.Win32.Sodin.dll
- Size 164KB
- Sample250203-e896saslgn
- SHA256 22e6baf4d3e4dba5f6f3ab349700d0169eeeb4a989b20b64a6aefba8be9fa64a
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\9cusbh84vd-readme.txt
-
sodinokibi
Ransom Note
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 9cusbh84vd. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3355E7C4CD1168BF 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/3355E7C4CD1168BF Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 1bft2wxaD3Vrz+n9A58LjzZxqHzLxr/ffs52GUVX8S30zEIK8FBPsWxCIOh4PJPG 7wUpXSDeOg8Rs6DhIoOtA/+qPjmoO7WFpJbbc/2EfdwGsUkXFAjBqcd0YsMkZCc4 fCIR7POxMqGdIF3aNwZiC9r7rl5wuQDefr5dlkxY0m2ecps0srJ5x4lYvrevYP83 EKkYcIQ1ToyRvanHEBwZxdgvCggkuLbQ90zNLkc+KjqV6SzfMaW+fEAawcB9iXiA u2tn2P0dmFF5RrHOkLLqmdRf58upBsoX6ctIF0iXe6NjYTHoVup04P5DtwMHDNGK yAwdjWfOE21cMxarSNwtzBWuvfRQGUlT6HVynfLeqZjgAXx+AheSl/nHb4DGgz42 3KpppQex88Q71uBxaLiajlp6nx8R10ywejAtDk7YgRoCoEP21wB/Ph3r4aJjQdsI H4Q1bbS0jOATR7dmHIR5lc3PVLxX6bo8Q2NDog6Lpni1SRrK6cEyq92zi2bnDvQK HMeMFXqoYFrYBh6lTycemzWUvA41jRcpMajo8GH6xHnpK7YbR0w5t93zHArkaKLQ OFVopgard7kPqEJwFTq4qc3AE0cu6gjykxXrtGJJtJjogm+DOhBGybAusJhfsmle h/v8VvogF/qOtdu56ONHY4AKuXRqVOu0AkZmfRtSzwEeNAAlw+/mEopamBHYLuKQ Fz2Qi4tsF/DiUW2DIFCRIMcZ/O6XoqFaO6vhCbNPWEqKs9PrYoFXl82y0Pzz9j7i VMRhRrLzDAFCRteMXpGk2b+1ZS/Sm30UyfJzZK8Rqku4cJsAA1Ifq5EMvKtE4G2f 7ef/7D89beGXCaNegWP8NSebyQ9gg8DyHWI+mk9D6ilqXAkMwk65Xog4ciECc/gH TUyFvy2v31nU+37s/WGi7mGUADkops9aS7glspVT94VZ/3X/6zX5l0KpIhn1rimK x6g/TOmHhfDZ+aj0U6bFNKWd+mLv014YaZ65vlTSZGDbxNQ+vsygaIrUF88TWzjS Tt68J6VH3i47DCkJwBOn+w+I+fc6jcl2ekfKf3LosZ4N4UbzFYw75v0ArhLDC5pH QhUVFHYJcVHQiTMug+s41xc5UfTdjQ4MeWkrX5uAxjgn7yGgK44rzaY8fVCY+XVY 6ehYeYSUwL6otUJ+xFan+S103yf1F/H/EdymM571hh/RobEOeUjJ3LdDTLSSthMh me97Z4E6poanUDvs5yDWO4s5kxRHwsj0GHV7fEVbCwf7YJT/K9673W4EkpqB7Q== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3355E7C4CD1168BF
-
http://decryptor.cc/3355E7C4CD1168BF
Signatures
- Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
- Sodinokibi family
- Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Program Files directory 18 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Trojan-Ransom.Win32.Sodin.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Trojan-Ransom.Win32.Sodin.dll,#12⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
9cusbh84vd-readme.txt
__PSScriptPolicyTest_zbt1aihn.wks.ps1
memory/3212-0-0x00007FFC8FD63000-0x00007FFC8FD65000-memory.dmp
memory/3212-1-0x0000023DA3100000-0x0000023DA3122000-memory.dmp
memory/3212-11-0x00007FFC8FD60000-0x00007FFC90822000-memory.dmp
memory/3212-12-0x00007FFC8FD60000-0x00007FFC90822000-memory.dmp
memory/3212-13-0x00007FFC8FD60000-0x00007FFC90822000-memory.dmp
memory/3212-16-0x00007FFC8FD60000-0x00007FFC90822000-memory.dmp