Resubmissions

25/03/2025, 13:41

250325-qzfrcswzht 10

05/02/2025, 10:51

250205-mx3lkatjgw 10

30/01/2025, 12:43

250130-pyd1ps1nby 10

Analysis

  • max time kernel
    92s
  • max time network
    96s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20250314-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
  • submitted
    25/03/2025, 13:41

General

  • Target

    Sodinokibi.exe

  • Size

    822KB

  • MD5

    4c811aa6fa4b6c24e325b0d71b84f710

  • SHA1

    389666ea397b3c51aeb147c8abb504c40b906d62

  • SHA256

    412e951a350b84f8c0d0a2db79029b4bbd6be624656f2a739db0fc00c6dbb52f

  • SHA512

    c33ccb7ed3c6a34d38fde8d824316012bc094abf7f62aad4472a00622500cd7a58cce43a13a26d8680d409a6a779ff36369669f97f91eea8ee50bcfd63f6fa3d

  • SSDEEP

    6144:NYk1/mCXu8BCnsq4MSt9kM5zaQrV+eXR:N/11u8BCnsq4zX5zlV+eB

Malware Config

Extracted

Family

sodinokibi

Botnet

26

Campaign

2361

Decoy

jacquesgarcianoto.com

csaballoons.com

buerocenter-butzbach-werbemittel.de

martha-frets-ceramics.nl

edvestors.org

mediogiro.com.ar

annenymus.com

circuit-diagramz.com

linkbuilding.life

endstarvation.com

nalliasmali.net

domaine-des-pothiers.com

floweringsun.org

haus-landliebe.de

mac-computer-support-hamburg.de

block-optic.com

gsconcretecoatings.com

osn.ro

vedsegaard.dk

grupoexin10.com

Attributes
  • net

    false

  • pid

    26

  • prc

    wordpad

    vxmon

    CagService

    visio

    synctime

    xfssvccon

    VeeamNFSSvc

    dbsnmp

    tbirdconfig

    thunderbird

    firefox

    VeeamDeploymentSvc

    sqbcoreservice

    thebat

    powerpnt

    vsnapvss

    agntsvc

    sql

    raw_agent_svc

    excel

    infopath

    pvlsvr

    mydesktopqos

    beserver

    ocssd

    EnterpriseClient

    winword

    outlook

    onenote

    oracle

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. ===--- Merry Christmas and Happy Holidays everyone! You have a great opportunity to enter the new year, leaving all the bad in the outgoing year. I advise you to write to us as soon as possible and not waste your precious time that you can spend with your family. With our decryptors recovery will take you the least time, without us you will have a very hard time and some of your files will not be recovered never. The longer you think, the harder it will be for us to negotiate with you . Waiting for your dialogues in our chat, below you can get acquainted with what happened. [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! For google: Revil/Sodinokibi

  • sub

    2361

  • svc

    sophos

    veeam

    vss

    AcronisAgent

    BackupExecJobEngine

    AcrSch2Svc

    BackupExecManagementService

    BackupExecVSSProvider

    mepocs

    stc_raw_agent

    bedbg

    MSExchange$

    MSExchange

    MVArmor

    CAARCUpdateSvc

    memtas

    MSSQL$

    BackupExecAgentBrowser

    PDVFSService

    WSBExchange

    sql

    ARSM

    svc$

    VeeamNFSSvc

    BackupExecRPCService

    CASAD2DWebSvc

    VeeamTransportSvc

    VeeamDeploymentService

    backup

    MVarmor64

Extracted

Path

C:\Program Files (x86)\8m2agp-readme.txt

Ransom Note
---=== Welcome. ===--- Merry Christmas and Happy Holidays everyone! You have a great opportunity to enter the new year, leaving all the bad in the outgoing year. I advise you to write to us as soon as possible and not waste your precious time that you can spend with your family. With our decryptors recovery will take you the least time, without us you will have a very hard time and some of your files will not be recovered never. The longer you think, the harder it will be for us to negotiate with you . Waiting for your dialogues in our chat, below you can get acquainted with what happened. [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 8m2agp. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8260614ACB873888 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/8260614ACB873888 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: O3rqpKYWj7AjE/zMScAxa/ySLUrGZSwWM4C8mAeoTMwLuNk16goxQXzPk5vtwmc8 /rF0FDL631koGrb2U4S0o6VXRItN/vk//LsZZI4PSzCWTV6FSxVsh9xE/vnpX5yY JlZgj+qgZqmBkX9fUN7RbPMcM9RKt6jiM4b3YL+b59b3vuCWISLQskQQmxIHXjKO r4mehNzpg+xFb4CvlpHUyd01h6yrvtfP43QWbKWFXTCE9iPSZ3tm+SdzgidjNzK4 QX8x8/5dyP9GncgMI4i5dvF4AlI7haA6eumTA+XDnSQYRWBioikfWrLLAj1W+7lc qZNtxDQgt0BYjO3zYZltxxZSwFTGFxAjF1YHbolbAfqPTB23o4RVNpkI89HpZF4c MyQhtEctsrc1NVBCN+EFDJ45pPRAHNycokVuEQAtxfUTHaq5W//GpWH+iKYdEZ+J USQcuj+7HmkoO7f9OP7gFlHtLNoVnc/XwAij9anZnvdNH97Gv80WoU86so0yruZ6 u6mFmcmnI8f04Z8sjAKRRf5rPuUXuD4xw9iJ5v1kKA4GtDBb4iLN79dtDHvqOjcN sUICexnmTFyfr+t6B/JEuKRt4RSw2Dsxum0ou9mtDki2FJzBeqJeOOA3zLjNzmC0 nZJPNnZw7faQjGvQeFREmI5jhDgj5r0IeP8bO4yNVDMvlvZsJYaMCMUxgCoJlOsE 201dbrm1I0jcYXQHh+491ixa7DOeW/SplvghtJe5KDPrfIuro4K9BvDRHQMH+Bop yo7Wj+AM79rQkFhUhrMGPp7RGuZYTmX8E/LRAh2xpYx4u3Y+GU4zv81X0OfkvCgF +XoKpek+mgvdHHLQ6idLDX/zmLi2bf2ZvSdJoesvafKToRULa4nTmkoYyOUJDvdn aQ2ElOP6DECkXkb0G2GRbAY6Fshq11SAssOsIOkiCK3EYoKU5d2DeZegyr67OqeC ptoXqQxpFnjvV5Ygzu8eNpDsU+TnIvM4fZUSCKOFnktC2T0EzHuENRuzafYqs/uB G1wGdupPSCP4J48GNGstrWFLheqZ4dVB6VvqdQjJxyjQmu8Jrl20Wf4oDE0QeCIj /VVSCeKNkhdHxRkS9Q9xoYlIqRK8nIgw9dZTp+PYJ6VpDWD7XEMDkiy8lEphpekK B1o+YTjW2dcwZwctv06kS7uXont1eL5mBLbiSNXwZFCenKA/l7MN/ffhaDRTj02b U0zJ5oxkgv06UTJh1s2KRst2v/uugQb7ekLQKB2ONUM0XSrnJr8= Extension name: 8m2agp ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! For google: Revil/Sodinokibi
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8260614ACB873888

http://decryptor.top/8260614ACB873888

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

  • Sodinokibi family
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Drops file in Program Files directory 16 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Sodinokibi.exe
    C:\Users\Admin\AppData\Local\Temp\Sodinokibi.exe bcdedit /set shutdown /r /f /t 2
    1⤵
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3096
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1112
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:4272
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1616

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\8m2agp-readme.txt

      Filesize

      7KB

      MD5

      00c8453d1899990564f9778c0879fcfc

      SHA1

      bc362e24c6b25f81af5f33c632ebf9454e719c46

      SHA256

      e7a7848577fe90c7606a267b85f1c172064c18a7145d76e77e63c75a6828699b

      SHA512

      0340d3746fe25475e883612a28f4210fc4d578004bc74917f0daea875016a24731caa6c8287e6867253c5ce1b787cf9dacbe216a26103b3dd4cdc257afc4afc4

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qd0obshl.ero.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • memory/1112-18-0x00007FF9DE8C0000-0x00007FF9DF382000-memory.dmp

      Filesize

      10.8MB

    • memory/1112-3-0x0000020FAD750000-0x0000020FAD772000-memory.dmp

      Filesize

      136KB

    • memory/1112-2-0x00007FF9DE8C3000-0x00007FF9DE8C5000-memory.dmp

      Filesize

      8KB

    • memory/1112-13-0x00007FF9DE8C0000-0x00007FF9DF382000-memory.dmp

      Filesize

      10.8MB

    • memory/1112-14-0x00007FF9DE8C0000-0x00007FF9DF382000-memory.dmp

      Filesize

      10.8MB

    • memory/1112-15-0x00007FF9DE8C0000-0x00007FF9DF382000-memory.dmp

      Filesize

      10.8MB

    • memory/3096-1-0x0000000000400000-0x0000000000449000-memory.dmp

      Filesize

      292KB

    • memory/3096-0-0x0000000000680000-0x00000000006C9000-memory.dmp

      Filesize

      292KB

    • memory/3096-408-0x0000000000680000-0x00000000006C9000-memory.dmp

      Filesize

      292KB

    • memory/3096-409-0x0000000000400000-0x0000000000449000-memory.dmp

      Filesize

      292KB

    • memory/3096-410-0x0000000000400000-0x00000000004D5000-memory.dmp

      Filesize

      852KB

    • memory/3096-413-0x0000000000400000-0x00000000004D5000-memory.dmp

      Filesize

      852KB

    • memory/3096-417-0x0000000000400000-0x00000000004D5000-memory.dmp

      Filesize

      852KB

    • memory/3096-418-0x0000000000400000-0x0000000000449000-memory.dmp

      Filesize

      292KB