Resubmissions
03/02/2025, 21:57
250203-1t5hmsvmat1003/02/2025, 04:37
250203-e896saslgn1031/01/2025, 18:35
250131-w8gmxatmc110Analysis
- max time kernel
726s - max time network
439s - platform
windows10-ltsc 2021_x64 - resource
win10ltsc2021-20250128-en - resource tags
- submitted
03/02/2025, 04:37
General
- Target bazaar.2020.02/HEUR-Trojan-Ransom.Win32.Sodin.dll
- Size 164KB
- Sample250203-e896saslgn
- SHA256 44bcefd86b7d36300eb2d77ba88f248cab5ecb9cfb0ec3e859e35ed519fa7795
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\5qjh6ci0-readme.txt
-
sodinokibi
Ransom Note
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 5qjh6ci0. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1A19C6356660D028 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/1A19C6356660D028 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: gHCSB3SS14cGvdafZagOwUh6OaW54HTfG2DMgq1r4vJtXl6oOEy9MU1AgOiwBi1e HQo8HrVK2vTypliO1thR9QG6Jd2YG91rJFtphSqoY/gBYKDAfUhegEtn2LNUgpUb CoDxFXZQEeek06VX9X9U/oEUnhDA7CG8FAz/e4rKro49typMb60iVbPEgbO69DiP TuPJk2y1Ywxb4fKKWs63HDj+ThH6AJNu9TAVxv04HkFYd1poHOb49qAbhc2vq9Mc ggacYQjQhRopKDy9HFHcR4UOXJa0DCpdCZC9uwxf8NEgUdncZKcJHsKQvBh+MNFv DDxZYb1Sskr7IRRxL6Io8ha6Uv+cs8f2njANudX0ipSkZYAGiZQk6SQjvUZ889o/ TR6jKppuYnrRqaGKTV8sQpWCJS/fFGStdS8B+otHIN8shiJkLXmo+wDEsQGWHfQW XrJbblZnuQ4bb9j72HEgkhRlJRAB7lAZmTcCOJ12UFRmGv7IpB9BrILD5ACRf7RT G2LLqbNDkiu1HaeO87NZPJxOOAVC4WXq75pXsE5B1rTYEoeB+z9JU6iUS3F5QOO2 +CEqVKX7r2tvvyqMx4p53GpNnVitXrDboQvUWwKjA1ijiCBQXtxVsz3/Ew+AWOMs JGHcV/07g9o6sI6bzOTwIyDek8sBz/bq9oCXWPheGdwLylvELHNXRC4uphXvjj2x OJ0a/k7gkp1zx2QKfaFGsIO0vl8tTASJoYLU4G3LYphKNtJPPD1GBRi0lvLTl3Jd Qgc2t3MXqkDGW5iikWXsUsU3Vx/L5g3vIQKFa1rhjJjrkN2k7UGMUY4wSo4SYLyE ONNAiNxd6PLlM+1YVHGtLXg/B5ijyjy0jPbEOMYUYkD85YbzGdNE06YijI0SLVI1 4Cl9PJX2VWbfX/4J+REzureLcY6nUUg+9+V87h9EXzh0GQ3+wElclRJEMZiRUgWv 6tJP6rAepUlovfR+gPnGSJp23Y81WeX1/5vlzOtTjJop4WUTBNVI22P6lToulHnl CxPizQoSIr1DBJkZHN/v8UCs91/8hoUHQOlahMg8CB0AWFRqnl3kWpwCJYIDLu7j tNQP5oc4vRMI5q/IFMC4HBvtRrYHQMjW1JvKeVqYuw222ueyAXXG2PjXUKbfMO/d 0m1Hz2OlY3e9iTiUJFivb9o23XykkMs/SEFM3tqAatZrnao/gChQHZawSjvcTG2u rmEAobMkcFvMu0bUpqPS7DM0H3m7AzIkUjG5SXYWXDi6XomH+ttj71Ct ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1A19C6356660D028
-
http://decryptor.cc/1A19C6356660D028
Signatures
- Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
- Sodinokibi family
- Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Program Files directory 13 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Trojan-Ransom.Win32.Sodin.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Trojan-Ransom.Win32.Sodin.dll,#12⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
5qjh6ci0-readme.txt
__PSScriptPolicyTest_4a4uxzqc.1vj.ps1
memory/1260-0-0x00007FFC1DA23000-0x00007FFC1DA25000-memory.dmp
memory/1260-10-0x000001B22CE70000-0x000001B22CE92000-memory.dmp
memory/1260-11-0x00007FFC1DA20000-0x00007FFC1E4E2000-memory.dmp
memory/1260-12-0x00007FFC1DA20000-0x00007FFC1E4E2000-memory.dmp
memory/1260-13-0x00007FFC1DA20000-0x00007FFC1E4E2000-memory.dmp
memory/1260-16-0x00007FFC1DA20000-0x00007FFC1E4E2000-memory.dmp