sodinokibi | 938e0e4868f00c4cda6f6b70542e6eb0d04982b706cd4eb5a4becb7c2da1fd3f

General

Target

m3kJUZkr.exe.dll
Size

116KB
MD5

0532e250400ded8515f6d042d388ff07
SHA1

e47ed9a5120f928da174a0178b1698aad8baf0b5
SHA256

938e0e4868f00c4cda6f6b70542e6eb0d04982b706cd4eb5a4becb7c2da1fd3f
SHA512

b03da56c18d7b084ce09fd3dfa1cfeb19c07ee5fc5b0bdbfb0ea935e72c6a4b5e1198aa3362e505d5e178c0df0ff2d8a479f8d96aba13d068343c72b0cc4f27e

Score

10^/10

ransomware sodinokibi persistence

Malware Config

Extracted

Path

C:\9938qi3-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 9938qi3. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/880230F23FF696FB 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/880230F23FF696FB Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 9kcyP49pC7/xXoV1tCkcIALFm/oq2OviP2f6Nf0prnOncW9X1k+SRCTpyWQTJRNO AgNalj8OT7oMizYPNiCqz30wwxYOHiPC7UF2RR+c4YUDu1dOMem4TYC0kGyq+N8z FnYW6lZfezmlEoFK9bPALa6BXucfTdEIQPcz4ZL9Ki9rpEFWhELKd3UXU8T0vY1b Eg8oVZtNKA8PutDCSNTRCffSIADu/oamENKwsyiBevcJ2oAWA1grsfIUiE8a7Eil wx6Jdzmp87zyfU/GDJ3PkEttf6ugxAgaxUH6a6KvZHUCLNMLHVZGAtI+rQXkQKwX ci9c1QLHpUAL+q3wCvUJ0e6wwKqN7/hx/cpLeoNWlImFr7Ig13J2rELwAPKvwaoT SunrTTxI5xMCBWq4J3qemiSr+ivo1v3t8G9901CuIcojRPmV85debwkpHx2LG6Hf taSAZR1Ok2QwxXTbXazAbcdNCciWf7OkacHJJPcCnGxleAGhlab2b9SR5NyH2CDs tUQ8dOtSHiZTl9Vy+eoC5eHk8lnsEaz+Kszk31l3ceQul46VBkRfnn0RvTaoEkIK G3j99HVdoYHdG2HWJl/XfnPrr0ybzxXs1ozlKma4KJWuInveCvCK72tDVlodNImp BpBNjeg+/YgLydbNz2Bf2u+VkfjsdNPG2caCPMOJGXrvq9f1UsA1KyLE/rx8yiLV nQVYS6j3Oxuv9aIbu6HeoTpOI0JX9FdMGcnvTgN1W2HylKWIDZcSQYiyeLVJOQxl jVo8kDZ/H0KW3pvDWTg3xp864VvO5Q6UmQY+gL3VPx6QWqhiHEdqN2uKjcGgjKtY pkprVpWAf9JrRToAKpiI8pP4imfHFIAqWR8q/yVDLb2HnYkcM1I5cNkiBm3NXJue mE5ZEmag9B2BKeFsO82O+rMePxTzT5FIaU+lvaS3gpPpGEy+Zv71BEVNk1DVExvN qDqHiZao4pUIz/EYymtzDXuSXCp8/kmo3MnfmzJt0DwBG4gK6nZHRISej61uGlZq LjVb69GOtYXhF8xHiAZ+fU+56APP0ROEiEzEID57Qv6RK3I5zREwOj+0ktHax2gR ETwmWnBNP1a5Z4KhWVIjJ55eraQTICXoDgeS+ws5c2HjvqLlvro5JB1Uji+GyH2p 1EB0r0u8QcAEL/GT66eoqwoZllyviJfofcOY8/lJLeX6yFtnsXxGXA8HT7YAj8mO eESXk7LUM4JiiO/5kghBJ5J9SMHK5kCuhresiegBUbiR+o0MkhzJ1thkFMNKcab/ KaVWFOuMWgunbgl2SOV753qu ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/880230F23FF696FB

http://decryptor.cc/880230F23FF696FB

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Blacklisted process makes network request 68 IoCs

Processes:

rundll32.exe

flow	pid	process
12	2888	rundll32.exe
14	2888	rundll32.exe
16	2888	rundll32.exe
18	2888	rundll32.exe
20	2888	rundll32.exe
22	2888	rundll32.exe
24	2888	rundll32.exe
26	2888	rundll32.exe
28	2888	rundll32.exe
30	2888	rundll32.exe
32	2888	rundll32.exe
34	2888	rundll32.exe
36	2888	rundll32.exe
39	2888	rundll32.exe
41	2888	rundll32.exe
43	2888	rundll32.exe
45	2888	rundll32.exe
47	2888	rundll32.exe
49	2888	rundll32.exe
51	2888	rundll32.exe
53	2888	rundll32.exe
55	2888	rundll32.exe
57	2888	rundll32.exe
59	2888	rundll32.exe
61	2888	rundll32.exe
63	2888	rundll32.exe
65	2888	rundll32.exe
67	2888	rundll32.exe
68	2888	rundll32.exe
70	2888	rundll32.exe
72	2888	rundll32.exe
74	2888	rundll32.exe
76	2888	rundll32.exe
78	2888	rundll32.exe
80	2888	rundll32.exe
82	2888	rundll32.exe
84	2888	rundll32.exe
86	2888	rundll32.exe
88	2888	rundll32.exe
90	2888	rundll32.exe
93	2888	rundll32.exe
95	2888	rundll32.exe
97	2888	rundll32.exe
99	2888	rundll32.exe
101	2888	rundll32.exe
103	2888	rundll32.exe
105	2888	rundll32.exe
107	2888	rundll32.exe
109	2888	rundll32.exe
111	2888	rundll32.exe
113	2888	rundll32.exe
115	2888	rundll32.exe
117	2888	rundll32.exe
118	2888	rundll32.exe
120	2888	rundll32.exe
122	2888	rundll32.exe
124	2888	rundll32.exe
126	2888	rundll32.exe
128	2888	rundll32.exe
130	2888	rundll32.exe
132	2888	rundll32.exe
134	2888	rundll32.exe
136	2888	rundll32.exe
139	2888	rundll32.exe

Modifies extensions of user files 7 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

rundll32.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\GrantUnlock.raw => \??\c:\users\admin\pictures\GrantUnlock.raw.9938qi3	rundll32.exe
File renamed	C:\Users\Admin\Pictures\ResolveSwitch.tiff => \??\c:\users\admin\pictures\ResolveSwitch.tiff.9938qi3	rundll32.exe
File renamed	C:\Users\Admin\Pictures\StepConvertFrom.raw => \??\c:\users\admin\pictures\StepConvertFrom.raw.9938qi3	rundll32.exe
File opened for modification	\??\c:\users\admin\pictures\ResolveSwitch.tiff	rundll32.exe
File renamed	C:\Users\Admin\Pictures\ApproveAssert.crw => \??\c:\users\admin\pictures\ApproveAssert.crw.9938qi3	rundll32.exe
File renamed	C:\Users\Admin\Pictures\DisableUnregister.tif => \??\c:\users\admin\pictures\DisableUnregister.tif.9938qi3	rundll32.exe
File renamed	C:\Users\Admin\Pictures\DismountSplit.tif => \??\c:\users\admin\pictures\DismountSplit.tif.9938qi3	rundll32.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\P:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\F:	rundll32.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\U:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\Q:	rundll32.exe
File opened (read-only)	\??\E:	rundll32.exe
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\M:	rundll32.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\A:	rundll32.exe
File opened (read-only)	\??\B:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe
File opened (read-only)	\??\D:	rundll32.exe
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\X:	rundll32.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\R:	rundll32.exe

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\36p17f2.bmp"	rundll32.exe

Drops file in Program Files directory 33 IoCs

Processes:

rundll32.exe

description	ioc	process
File opened for modification	\??\c:\program files\GroupAdd.txt	rundll32.exe
File opened for modification	\??\c:\program files\SplitLock.vdw	rundll32.exe
File opened for modification	\??\c:\program files\DismountInvoke.TTS	rundll32.exe
File opened for modification	\??\c:\program files\PingRead.wvx	rundll32.exe
File opened for modification	\??\c:\program files\SubmitExport.mpv2	rundll32.exe
File opened for modification	\??\c:\program files\ResizeApprove.ppsx	rundll32.exe
File opened for modification	\??\c:\program files\SyncShow.potm	rundll32.exe
File opened for modification	\??\c:\program files\ConvertRead.easmx	rundll32.exe
File opened for modification	\??\c:\program files\RestartClear.svgz	rundll32.exe
File opened for modification	\??\c:\program files\RestoreInitialize.wav	rundll32.exe
File opened for modification	\??\c:\program files\SkipSubmit.ram	rundll32.exe
File opened for modification	\??\c:\program files\UnpublishRemove.docx	rundll32.exe
File created	\??\c:\program files\9938qi3-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\ShowRepair.xps	rundll32.exe
File opened for modification	\??\c:\program files\UpdateStep.mpeg3	rundll32.exe
File created	\??\c:\program files (x86)\9938qi3-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\CompressResume.kix	rundll32.exe
File opened for modification	\??\c:\program files\InstallSwitch.ogg	rundll32.exe
File opened for modification	\??\c:\program files\MergeUpdate.au	rundll32.exe
File opened for modification	\??\c:\program files\StepSwitch.pot	rundll32.exe
File opened for modification	\??\c:\program files\StopLock.ADTS	rundll32.exe
File opened for modification	\??\c:\program files\SubmitEnable.aiff	rundll32.exe
File opened for modification	\??\c:\program files\InstallEnable.mp2	rundll32.exe
File opened for modification	\??\c:\program files\OptimizeMove.AAC	rundll32.exe
File opened for modification	\??\c:\program files\PingTrace.gif	rundll32.exe
File opened for modification	\??\c:\program files\ReadMerge.vdw	rundll32.exe
File opened for modification	\??\c:\program files\RevokeApprove.xsl	rundll32.exe
File opened for modification	\??\c:\program files\UnpublishCopy.pptx	rundll32.exe
File opened for modification	\??\c:\program files\CloseSplit.ods	rundll32.exe
File opened for modification	\??\c:\program files\OptimizeConfirm.xla	rundll32.exe
File opened for modification	\??\c:\program files\SplitUnprotect.wax	rundll32.exe
File opened for modification	\??\c:\program files\SyncEdit.zip	rundll32.exe
File opened for modification	\??\c:\program files\WriteUpdate.vb	rundll32.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b06010505070308060a2b0601040182370a030406082b0601050507030606082b0601050507030106082b0601050507030706082b0601050507030206082b0601050507030406082b0601050507030353000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d5503000000010000001400000002faf3e291435468607857694df5e45b6885186820000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0400000001000000100000001d3554048578b03f42424dbf20730a3f03000000010000001400000002faf3e291435468607857694df5e45b688518681d000000010000001000000006f9583c00a763c23fb9e065a3366d55140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20b00000001000000260000005300650063007400690067006f0020002800410064006400540072007500730074002900000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b06010505070308060a2b0601040182370a030406082b0601050507030606082b0601050507030106082b0601050507030706082b0601050507030206082b0601050507030406082b060105050703030f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 19000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b06010505070308060a2b0601040182370a030406082b0601050507030606082b0601050507030106082b0601050507030706082b0601050507030206082b0601050507030406082b0601050507030353000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d5503000000010000001400000002faf3e291435468607857694df5e45b688518680400000001000000100000001d3554048578b03f42424dbf20730a3f20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 5c0000000100000004000000000800000400000001000000100000001d3554048578b03f42424dbf20730a3f03000000010000001400000002faf3e291435468607857694df5e45b688518681d000000010000001000000006f9583c00a763c23fb9e065a3366d55140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20b00000001000000260000005300650063007400690067006f0020002800410064006400540072007500730074002900000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b06010505070308060a2b0601040182370a030406082b0601050507030606082b0601050507030106082b0601050507030706082b0601050507030206082b0601050507030406082b060105050703030f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b19000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

2888 rundll32.exe
2888 rundll32.exe

pid	process
2888	rundll32.exe
2888	rundll32.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

rundll32.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	2888	rundll32.exe
Token: SeTakeOwnershipPrivilege	2888	rundll32.exe
Token: SeBackupPrivilege	1872	vssvc.exe
Token: SeRestorePrivilege	1872	vssvc.exe
Token: SeAuditPrivilege	1872	vssvc.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3588 wrote to memory of 2888	3588	rundll32.exe	rundll32.exe
PID 3588 wrote to memory of 2888	3588	rundll32.exe	rundll32.exe
PID 3588 wrote to memory of 2888	3588	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\m3kJUZkr.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3588

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\m3kJUZkr.exe.dll,#1
2⤵
- Blacklisted process makes network request
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2888