Resubmissions
03/02/2025, 21:57
250203-1t5hmsvmat1003/02/2025, 04:37
250203-e896saslgn1031/01/2025, 18:35
250131-w8gmxatmc110Analysis
- max time kernel
726s - max time network
529s - platform
windows10-ltsc 2021_x64 - resource
win10ltsc2021-20250128-en - resource tags
- submitted
03/02/2025, 04:37
General
- Target bazaar.2020.02/HEUR-Trojan-Ransom.Win32.Sodin.dll
- Size 164KB
- Sample250203-e896saslgn
- SHA256 578e1b00157447f99716b646af6b0c33d0f6c32257a19376d6cc9d003ff0fba1
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\ov9gzwf-readme.txt
-
sodinokibi
Ransom Note
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension ov9gzwf. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7462F01832E0D822 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/7462F01832E0D822 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: JbWZtBfPUlgzUO4opoON8I9G+VWwyQ3V8vFDKkxoH/F+KLoTdpNvwskHC43AZUq5 IWsSDBgLwcgIdHfscgw1tiqThgb7oJIjZKFcWY6SeoYHVfZ2+h75cKk1FP4WlpPj py5Zvju8dgfzRPG+23xfr4U4nXFyb+P1DOCDra1kTJoDMxulPgL24hcXdRN8x1vl HYvsU2zyCrNo2xuXQJFvcXal4hc98EFYNqqs+WQ0nw9BYYOxCJhYKIuNkRcI0wMo wqxOmyBEP++xHhF7JHeMm4QtgYIm54nqrDuQYC4bd3MmRW3wk2LJjnB3lsiLWvMj LZ5tcTyyawsWyuoYyU+QzQQKI9DqR5NIRgyclmESPGNUjY2LURtIM/zonUEQF0xH 40pBd0mKVHuTtIqjQxiwQU0deYAaPMfD8kn9j0wIFyITtT3cLBROpBVMj6spbBrE MZRZBrTN1osdgPdO40TxeUFf4tcOCxMLS2pYSsqlLuEBfDRfUcgPnDLpwsdBL4QE 29suS7C/0NY+PfvA1OFTGEKlobF2A0GPz5mtnCLGnJxDmCZOC3NGOnV984aiZLO7 9GwmK+lBxwfhukLL8pbzNMjbNlVr9b/ke9hRqUXwXJhpaQBj6Apxgh2+ODmcj4c5 2q+qyPMTG/euC5vt7bdbclKmqxAM9I/EH2aZK6lwKDuI6ns/fmIR9Z+4PRMbBY+D xZE2L/pDzDELgFClKf1ScfqkJRD/BvVnOG+S5UjjmMSNuxzi4m7x97azX3jjnMcb xtDIQKyu2uJGGnasm/3Qmsilfq40+LklH5qMfYKfQh2uARkWVC3k/hH4/zypO7MT gKMzUgXmuMLJsrgsOWJGSQRxeok6yGz/k2jpjYWqx2gmla+VCyWmxiXqOSZz04mY w21WbxaT662yf2HpCtJ0xfZhyxpnOKvs94UKllJ/HWN4CU03iGV91A8WYcJxkfHY r5CVxxef1Cm1hfORXgSHLVCbq9T8t1qXq3+taSWdtAb4eDf863RCKZYtBdpavID2 BfyLyuFQ5+5kti/F/dQ4+91YFtGfDSiEtZrFHTeG6sw1tX3vP5A180OajZMjF3pb 0plUGgcciSmtwKpFVqZcIH0QCXGuovKLS22BHR4ORWIb1F1pj3M1tQSAG99v9cc8 SZ1T4tPaERk9o77EUl9YNfLPw8lJQ6owca/cwDNWZgzRzwlfHGW+t8rZTDzyMb82 iAVQLXySnxTeRzKuPYiCPE6eoWDGvszczF3jpYl05+U8Rs0EvJmwnA== Extension name: ov9gzwf ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7462F01832E0D822
-
http://decryptor.top/7462F01832E0D822
Signatures
- Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
- Sodinokibi family
- Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Program Files directory 16 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Trojan-Ransom.Win32.Sodin.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Trojan-Ransom.Win32.Sodin.dll,#12⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_0dp1w525.xli.ps1
ov9gzwf-readme.txt
memory/4800-0-0x00007FFEEB9B3000-0x00007FFEEB9B5000-memory.dmp
memory/4800-1-0x00000296B08E0000-0x00000296B0902000-memory.dmp
memory/4800-11-0x00007FFEEB9B0000-0x00007FFEEC472000-memory.dmp
memory/4800-12-0x00007FFEEB9B0000-0x00007FFEEC472000-memory.dmp
memory/4800-13-0x00007FFEEB9B0000-0x00007FFEEC472000-memory.dmp
memory/4800-16-0x00007FFEEB9B0000-0x00007FFEEC472000-memory.dmp