Analysis
-
max time kernel
1801s -
max time network
1806s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
23-08-2021 11:10
Static task
static1
Behavioral task
behavioral1
Sample
d8353cfc5e696d3ae402c7c70565c1e7f31e49bcf74a6e12e5ab044f306b4b20.dll
Resource
win7v20210410
Behavioral task
behavioral2
Sample
d8353cfc5e696d3ae402c7c70565c1e7f31e49bcf74a6e12e5ab044f306b4b20.dll
Resource
win10v20210410
General
-
Target
d8353cfc5e696d3ae402c7c70565c1e7f31e49bcf74a6e12e5ab044f306b4b20.dll
-
Size
813KB
-
MD5
849fb558745e4089a8232312594b21d2
-
SHA1
1bcf1ae39b898aaa8b6b0207d7e307b234614ff6
-
SHA256
d8353cfc5e696d3ae402c7c70565c1e7f31e49bcf74a6e12e5ab044f306b4b20
-
SHA512
48d1e77e426d0a96b55e54c4cd81e8376395f17fe1efa5f11467ecfa8f214c52cc202c561be76ddc8a9958fbba74250947fba0310ce9febaa46894f7454a2bbb
Malware Config
Extracted
C:\vwt3rqqt-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E05F017F5B0159C4
http://decoder.re/E05F017F5B0159C4
Extracted
sodinokibi
$2a$12$vdqTdjoXfyV.wBOEx9g4ZOFEY483G1yccC4Z7M8GlMP7FMtV5yWcm
7598
ecoledansemulhouse.fr
promesapuertorico.com
oldschoolfun.net
hardinggroup.com
fax-payday-loans.com
chrissieperry.com
chandlerpd.com
birnam-wood.com
ivfminiua.com
berlin-bamboo-bikes.org
vesinhnha.com.vn
geisterradler.de
lefumetdesdombes.com
slimani.net
vyhino-zhulebino-24.ru
lusak.at
101gowrie.com
pixelarttees.com
live-your-life.jp
yamalevents.com
ivivo.es
pcprofessor.com
milanonotai.it
brevitempore.net
herbayupro.com
securityfmm.com
rerekatu.com
highlinesouthasc.com
oncarrot.com
freie-baugutachterpraxis.de
365questions.org
arteservicefabbro.com
augenta.com
creamery201.com
expandet.dk
bristolaeroclub.co.uk
answerstest.ru
schoellhammer.com
jenniferandersonwriter.com
associationanalytics.com
lapinvihreat.fi
mdk-mediadesign.de
gasbarre.com
effortlesspromo.com
sla-paris.com
cleliaekiko.online
tstaffing.nl
hairnetty.wordpress.com
cnoia.org
bodyfulls.com
maryloutaylor.com
pogypneu.sk
memaag.com
4net.guru
d1franchise.com
ilso.net
www1.proresult.no
campus2day.de
transportesycementoshidalgo.es
bingonearme.org
wolf-glas-und-kunst.de
iwr.nl
turkcaparbariatrics.com
solhaug.tk
oneheartwarriors.at
paulisdogshop.de
hellohope.com
stingraybeach.com
4youbeautysalon.com
vitavia.lt
precisionbevel.com
live-con-arte.de
crowd-patch.co.uk
carrybrands.nl
web.ion.ag
rosavalamedahr.com
verytycs.com
tecnojobsnet.com
onlyresultsmarketing.com
rocketccw.com
artige.com
danielblum.info
smejump.co.th
craigmccabe.fun
igrealestate.com
gopackapp.com
polymedia.dk
theduke.de
thefixhut.com
forskolorna.org
educar.org
fayrecreations.com
thailandholic.com
allfortheloveofyou.com
intecwi.com
labobit.it
abuelos.com
rota-installations.co.uk
rieed.de
xlarge.at
levdittliv.se
paradicepacks.com
jadwalbolanet.info
bodyforwife.com
c2e-poitiers.com
architecturalfiberglass.org
solerluethi-allart.ch
whittier5k.com
fotoideaymedia.es
art2gointerieurprojecten.nl
jbbjw.com
waermetauscher-berechnen.de
rumahminangberdaya.com
dr-seleznev.com
cortec-neuro.com
simpliza.com
tastewilliamsburg.com
bigasgrup.com
withahmed.com
copystar.co.uk
sotsioloogia.ee
mrsfieldskc.com
dr-tremel-rednitzhembach.de
maratonaclubedeportugal.com
architekturbuero-wagner.net
firstpaymentservices.com
greenfieldoptimaldentalcare.com
markelbroch.com
cafemattmeera.com
homecomingstudio.com
suncrestcabinets.ca
webmaster-peloton.com
craigvalentineacademy.com
loprus.pl
aunexis.ch
aakritpatel.com
yassir.pro
kao.at
geekwork.pl
brigitte-erler.com
pivoineetc.fr
cirugiauretra.es
xn--rumung-bua.online
profectis.de
starsarecircular.org
frontierweldingllc.com
devstyle.org
moveonnews.com
lascuola.nl
charlottepoudroux-photographie.fr
travelffeine.com
johnsonfamilyfarmblog.wordpress.com
uranus.nl
denifl-consulting.at
ledmes.ru
almosthomedogrescue.dog
wien-mitte.co.at
onlybacklink.com
adoptioperheet.fi
danubecloud.com
elpa.se
ussmontanacommittee.us
bee4win.com
sobreholanda.com
real-estate-experts.com
iwelt.de
neuschelectrical.co.za
mooglee.com
humanityplus.org
em-gmbh.ch
commonground-stories.com
associacioesportivapolitg.cat
todocaracoles.com
div-vertriebsforschung.de
alhashem.net
austinlchurch.com
reddysbakery.com
levihotelspa.fi
systemate.dk
35-40konkatsu.net
1team.es
chefdays.de
ravensnesthomegoods.com
xn--vrftet-pua.biz
abogadosaccidentetraficosevilla.es
shiresresidential.com
stoeferlehalle.de
tigsltd.com
smartypractice.com
finde-deine-marke.de
hoteledenpadova.it
argos.wityu.fund
dinslips.se
urist-bogatyr.ru
cursoporcelanatoliquido.online
naturalrapids.com
synlab.lt
leoben.at
seevilla-dr-sturm.at
epwritescom.wordpress.com
drugdevice.org
uimaan.fi
pasivect.co.uk
ceres.org.au
noesis.tech
supportsumba.nl
beyondmarcomdotcom.wordpress.com
kamienny-dywan24.pl
insigniapmg.com
idemblogs.com
lbcframingelectrical.com
lukeshepley.wordpress.com
nancy-informatique.fr
kunze-immobilien.de
buymedical.biz
alvinschwartz.wordpress.com
executiveairllc.com
dublikator.com
qlog.de
henricekupper.com
surespark.org.uk
body-guards.it
michaelsmeriglioracing.com
gadgetedges.com
basisschooldezonnewijzer.nl
wmiadmin.com
klimt2012.info
delawarecorporatelaw.com
schutting-info.nl
skanah.com
karacaoglu.nl
gonzalezfornes.es
vermoote.de
pointos.com
hushavefritid.dk
tsklogistik.eu
revezlimage.com
havecamerawilltravel2017.wordpress.com
mountsoul.de
juneauopioidworkgroup.org
friendsandbrgrs.com
woodworkersolution.com
lynsayshepherd.co.uk
verbisonline.com
babcockchurch.org
schmalhorst.de
southeasternacademyofprosthodontics.org
luckypatcher-apkz.com
parkstreetauto.net
bradynursery.com
richard-felix.co.uk
naturavetal.hr
biapi-coaching.fr
rksbusiness.com
lecantou-coworking.com
zweerscreatives.nl
marietteaernoudts.nl
advokathuset.dk
centromarysalud.com
aglend.com.au
talentwunder.com
sairaku.net
fatfreezingmachines.com
hotelsolbh.com.br
edgewoodestates.org
penco.ie
mank.de
jorgobe.at
personalenhancementcenter.com
team-montage.dk
bbsmobler.se
burkert-ideenreich.de
id-vet.com
lykkeliv.net
fibrofolliculoma.info
syndikat-asphaltfieber.de
theshungiteexperience.com.au
beaconhealthsystem.org
figura.team
visiativ-industry.fr
foryourhealth.live
danskretursystem.dk
shhealthlaw.com
westdeptfordbuyrite.com
tennisclubetten.nl
creative-waves.co.uk
jyzdesign.com
eco-southafrica.com
oemands.dk
coding-marking.com
deltacleta.cat
abogados-en-alicante.es
baronloan.org
mytechnoway.com
oneplusresource.org
winrace.no
siluet-decor.ru
lange.host
dontpassthepepper.com
bunburyfreightservices.com.au
bouncingbonanza.com
woodleyacademy.org
autopfand24.de
admos-gleitlager.de
bargningavesta.se
xtptrack.com
mapawood.com
igorbarbosa.com
songunceliptv.com
tandartspraktijkheesch.nl
mymoneyforex.com
lescomtesdemean.be
officehymy.com
anthonystreetrimming.com
stacyloeb.com
gamesboard.info
sauschneider.info
scenepublique.net
blewback.com
importardechina.info
acomprarseguidores.com
edelman.jp
evergreen-fishing.com
advizewealth.com
alfa-stroy72.com
macabaneaupaysflechois.com
bildungsunderlebnis.haus
justinvieira.com
transliminaltribe.wordpress.com
bundabergeyeclinic.com.au
xn--singlebrsen-vergleich-nec.com
trulynolen.co.uk
mrtour.site
you-bysia.com.au
praxis-management-plus.de
innote.fi
vickiegrayimages.com
devlaur.com
wacochamber.com
no-plans.com
vancouver-print.ca
xn--fn-kka.no
plantag.de
wari.com.pe
tenacitytenfold.com
nijaplay.com
danholzmann.com
xn--fnsterputssollentuna-39b.se
walkingdeadnj.com
qualitus.com
tonelektro.nl
colorofhorses.com
theclubms.com
journeybacktolife.com
mooshine.com
ecopro-kanto.com
presseclub-magdeburg.de
ditog.fr
facettenreich27.de
lmtprovisions.com
antenanavi.com
adultgamezone.com
quizzingbee.com
irinaverwer.com
cactusthebrand.com
kevinjodea.com
bloggyboulga.net
mediaplayertest.net
ilive.lt
smalltownideamill.wordpress.com
thaysa.com
bargningharnosand.se
ohidesign.com
tophumanservicescourses.com
321play.com.hk
micahkoleoso.de
vdberg-autoimport.nl
urclan.net
heliomotion.com
blog.solutionsarchitect.guru
psa-sec.de
myteamgenius.com
simulatebrain.com
besttechie.com
mepavex.nl
familypark40.com
insp.bi
dpo-as-a-service.com
cursosgratuitosnainternet.com
biortaggivaldelsa.com
piajeppesen.dk
anybookreader.de
tongdaifpthaiphong.net
wurmpower.at
global-kids.info
brandl-blumen.de
first-2-aid-u.com
kisplanning.com.au
psnacademy.in
aselbermachen.com
mrxermon.de
gasolspecialisten.se
id-et-d.fr
tinyagency.com
deoudedorpskernnoordwijk.nl
testzandbakmetmening.online
limassoldriving.com
shonacox.com
durganews.com
globedivers.wordpress.com
mirjamholleman.nl
mooreslawngarden.com
luxurytv.jp
coastalbridgeadvisors.com
chatizel-paysage.fr
slimidealherbal.com
remcakram.com
fiscalsort.com
osterberg.fi
boulderwelt-muenchen-west.de
esope-formation.fr
parking.netgateway.eu
gastsicht.de
filmvideoweb.com
pelorus.group
galserwis.pl
asteriag.com
alten-mebel63.ru
dutchbrewingcoffee.com
spsshomeworkhelp.com
smhydro.com.pl
rushhourappliances.com
ctrler.cn
zewatchers.com
zimmerei-fl.de
alysonhoward.com
forestlakeuca.org.au
myzk.site
phantastyk.com
narcert.com
dnepr-beskid.com.ua
evangelische-pfarrgemeinde-tuniberg.de
darnallwellbeing.org.uk
charlesreger.com
purposeadvisorsolutions.com
gporf.fr
knowledgemuseumbd.com
amerikansktgodis.se
appsformacpc.com
ftf.or.at
proudground.org
operaslovakia.sk
iviaggisonciliegie.it
boosthybrid.com.au
norovirus-ratgeber.de
apprendrelaudit.com
gymnasedumanagement.com
miriamgrimm.de
mbxvii.com
smokeysstoves.com
zzyjtsgls.com
funjose.org.gt
carolinepenn.com
nhadatcanho247.com
chavesdoareeiro.com
baumkuchenexpo.jp
linnankellari.fi
vox-surveys.com
bockamp.com
maasreusel.nl
pay4essays.net
webcodingstudio.com
zonamovie21.net
groupe-frayssinet.fr
mediaacademy-iraq.org
waynela.com
toreria.es
sloverse.com
cityorchardhtx.com
corelifenutrition.com
faronics.com
gantungankunciakrilikbandung.com
pv-design.de
csgospeltips.se
xn--thucmctc-13a1357egba.com
raschlosser.de
dubnew.com
airconditioning-waalwijk.nl
abitur-undwieweiter.de
caffeinternet.it
joseconstela.com
hihaho.com
kuntokeskusrok.fi
notsilentmd.org
garage-lecompte-rouen.fr
x-ray.ca
bordercollie-nim.nl
gemeentehetkompas.nl
slashdb.com
zso-mannheim.de
conasmanagement.de
diversiapsicologia.es
ai-spt.jp
blumenhof-wegleitner.at
ladelirante.fr
noskierrenteria.com
minipara.com
liikelataamo.fi
hannah-fink.de
dekkinngay.com
caribdoctor.org
ateliergamila.com
romeguidedvisit.com
higadograsoweb.com
deepsouthclothingcompany.com
behavioralmedicinespecialists.com
bastutunnan.se
fitnessbazaar.com
lightair.com
craftleathermnl.com
falcou.fr
stoeberstuuv.de
hashkasolutindo.com
unetica.fr
huissier-creteil.com
sporthamper.com
musictreehouse.net
fensterbau-ziegler.de
crediacces.com
femxarxa.cat
triggi.de
pt-arnold.de
midmohandyman.com
corola.es
maineemploymentlawyerblog.com
itelagen.com
imadarchid.com
i-arslan.de
socstrp.org
tomaso.gr
projetlyonturin.fr
mir-na-iznanku.com
retroearthstudio.com
helenekowalsky.com
theadventureedge.com
modelmaking.nl
drnice.de
sojamindbody.com
themadbotter.com
naturstein-hotte.de
hrabritelefon.hr
antiaginghealthbenefits.com
partnertaxi.sk
ecpmedia.vn
pcp-nc.com
balticdermatology.lt
ra-staudte.de
praxis-foerderdiagnostik.de
gmto.fr
farhaani.com
restaurantesszimmer.de
connectedace.com
christinarebuffetcourses.com
tanzprojekt.com
spacecitysisters.org
urmasiimariiuniri.ro
otsu-bon.com
international-sound-awards.com
foretprivee.ca
joyeriaorindia.com
nachhilfe-unterricht.com
lachofikschiet.nl
blogdecachorros.com
ikads.org
mediaclan.info
aprepol.com
whyinterestingly.ru
igfap.com
stemenstilte.nl
lubetkinmediacompanies.com
kindersitze-vergleich.de
ouryoungminds.wordpress.com
theapifactory.com
freie-gewerkschaften.de
hokagestore.com
ziegler-praezisionsteile.de
fannmedias.com
summitmarketingstrategies.com
mdacares.com
kmbshipping.co.uk
hatech.io
goodgirlrecovery.com
leather-factory.co.jp
launchhubl.com
jakekozmor.com
celeclub.org
simpkinsedwards.co.uk
autofolierung-lu.de
pasvenska.se
shsthepapercut.com
aodaichandung.com
kafu.ch
corona-handles.com
sipstroysochi.ru
qualitaetstag.de
solinegraphic.com
latribuessentielle.com
pmcimpact.com
nestor-swiss.ch
thewellnessmimi.com
takeflat.com
kaliber.co.jp
milsing.hr
spectrmash.ru
stormwall.se
galleryartfair.com
irishmachineryauctions.com
ausair.com.au
bookspeopleplaces.com
puertamatic.es
love30-chanko.com
teknoz.net
centuryrs.com
artotelamsterdam.com
anteniti.com
DupontSellsHomes.com
commercialboatbuilding.com
noixdecocom.fr
lillegrandpalais.com
cerebralforce.net
waveneyrivercentre.co.uk
selfoutlet.com
hexcreatives.co
smessier.com
leeuwardenstudentcity.nl
spargel-kochen.de
delchacay.com.ar
bouldercafe-wuppertal.de
lapmangfpt.info.vn
pubweb.carnet.hr
wellplast.se
greenko.pl
fitnessingbyjessica.com
thomas-hospital.de
unim.su
collaborativeclassroom.org
tandartspraktijkhartjegroningen.nl
kojima-shihou.com
coursio.com
the-virtualizer.com
verifort-capital.de
euro-trend.pl
drinkseed.com
sportiomsportfondsen.nl
mmgdouai.fr
marketingsulweb.com
peterstrobos.com
cheminpsy.fr
panelsandwichmadrid.es
stopilhan.com
kingfamily.construction
chaotrang.com
dirittosanitario.biz
bridgeloanslenders.com
employeesurveys.com
saarland-thermen-resort.com
sachnendoc.com
icpcnj.org
homng.net
roygolden.com
geoffreymeuli.com
ogdenvision.com
parebrise-tla.fr
renergysolution.com
hvccfloorcare.com
mezhdu-delom.ru
run4study.com
navyfederalautooverseas.com
vetapharma.fr
smogathon.com
ahouseforlease.com
d2marketing.co.uk
bestbet.com
aminaboutique247.com
wraithco.com
iphoneszervizbudapest.hu
mercantedifiori.com
brawnmediany.com
zieglerbrothers.de
worldhealthbasicinfo.com
otto-bollmann.de
financescorecard.com
villa-marrakesch.de
simplyblessedbykeepingitreal.com
amylendscrestview.com
pinkexcel.com
montrium.com
dushka.ua
dlc.berlin
gw2guilds.org
porno-gringo.com
cuppacap.com
aurum-juweliere.de
abl1.net
iyengaryogacharlotte.com
pomodori-pizzeria.de
manifestinglab.com
bsaship.com
kampotpepper.gives
bauertree.com
liveottelut.com
herbstfeststaefa.ch
vietlawconsultancy.com
sabel-bf.com
buroludo.nl
cranleighscoutgroup.org
8449nohate.org
zimmerei-deboer.de
softsproductkey.com
victoriousfestival.co.uk
kissit.ca
dramagickcom.wordpress.com
coffreo.biz
vannesteconstruct.be
cyntox.com
mastertechengineering.com
interactcenter.org
julis-lsa.de
planchaavapor.net
thomasvicino.com
psc.de
quemargrasa.net
leda-ukraine.com.ua
groupe-cets.com
baptisttabernacle.com
embracinghiscall.com
latestmodsapks.com
braffinjurylawfirm.com
tanciu.com
tuuliautio.fi
vorotauu.ru
prochain-voyage.net
naswrrg.org
zenderthelender.com
baylegacy.com
darrenkeslerministries.com
trystana.com
toponlinecasinosuk.co.uk
tips.technology
digi-talents.com
bhwlawfirm.com
manutouchmassage.com
lebellevue.fr
deko4you.at
deprobatehelp.com
datacenters-in-europe.com
theletter.company
heidelbergartstudio.gallery
homesdollar.com
clos-galant.com
ralister.co.uk
coding-machine.com
strandcampingdoonbeg.com
hugoversichert.de
parks-nuernberg.de
jobcenterkenya.com
trapiantofue.it
senson.fi
nsec.se
jerling.de
compliancesolutionsstrategies.com
broseller.com
notmissingout.com
gaiam.nl
spylista.com
thedresserie.com
hmsdanmark.dk
werkkring.nl
quickyfunds.com
roadwarrior.app
happyeasterimages.org
sanyue119.com
sarbatkhalsafoundation.org
xn--logopdie-leverkusen-kwb.de
better.town
filmstreamingvfcomplet.be
dsl-ip.de
walter-lemm.de
n1-headache.com
shiftinspiration.com
elimchan.com
jobmap.at
vloeren-nu.nl
modestmanagement.com
licor43.de
eraorastudio.com
plv.media
erstatningsadvokaterne.dk
wychowanieprzedszkolne.pl
cimanchesterescorts.co.uk
entopic.com
cuspdental.com
odiclinic.org
faizanullah.com
promalaga.es
blossombeyond50.com
punchbaby.com
exenberger.at
lichencafe.com
new.devon.gov.uk
sw1m.ru
beautychance.se
heurigen-bauer.at
citymax-cr.com
vitalyscenter.es
thedad.com
truenyc.co
devok.info
katiekerr.co.uk
radaradvies.nl
nativeformulas.com
dutchcoder.nl
accountancywijchen.nl
kikedeoliveira.com
makeflowers.ru
crowcanyon.com
pferdebiester.de
makeurvoiceheard.com
oslomf.no
alsace-first.com
healthyyworkout.com
ulyssemarketing.com
krcove-zily.eu
ausbeverage.com.au
aarvorg.com
serce.info.pl
twohourswithlena.wordpress.com
space.ua
thee.network
2ekeus.nl
fitovitaforum.com
nosuchthingasgovernment.com
ihr-news.jp
myhostcloud.com
spd-ehningen.de
meusharklinithome.wordpress.com
podsosnami.ru
tulsawaterheaterinstallation.com
berliner-versicherungsvergleich.de
littlebird.salon
skiltogprint.no
agence-referencement-naturel-geneve.net
koken-voor-baby.nl
dareckleyministries.com
nokesvilledentistry.com
kojinsaisei.info
kadesignandbuild.co.uk
mylovelybluesky.com
rozemondcoaching.nl
schlafsack-test.net
daniel-akermann-architektur-und-planung.ch
degroenetunnel.com
fotoscondron.com
lapinlviasennus.fi
highimpactoutdoors.net
actecfoundation.org
klusbeter.nl
logopaedie-blomberg.de
dubscollective.com
kamahouse.net
autodujos.lt
jusibe.com
muamuadolls.com
i-trust.dk
waywithwords.net
cite4me.org
caribbeansunpoker.com
people-biz.com
kosterra.com
nuzech.com
ccpbroadband.com
teczowadolina.bytom.pl
izzi360.com
harveybp.com
girlillamarketing.com
andersongilmour.co.uk
rimborsobancario.net
analiticapublica.es
teresianmedia.org
hypozentrum.com
12starhd.online
webhostingsrbija.rs
croftprecision.co.uk
iqbalscientific.com
veybachcenter.de
drfoyle.com
despedidascostablanca.es
body-armour.online
easytrans.com.au
huesges-gruppe.de
tomoiyuma.com
kariokids.com
allamatberedare.se
argenblogs.com.ar
nandistribution.nl
pridoxmaterieel.nl
mousepad-direkt.de
portoesdofarrobo.com
mirkoreisser.de
sinal.org
sportverein-tambach.de
sanaia.com
tampaallen.com
katketytaanet.fi
jsfg.com
nakupunafoundation.org
catholicmusicfest.com
edv-live.de
ligiercenter-sachsen.de
merzi.info
tanzschule-kieber.de
judithjansen.com
triactis.com
sterlingessay.com
bafuncs.org
slwgs.org
ceid.info.tr
asgestion.com
denovofoodsgroup.com
marathonerpaolo.com
bricotienda.com
rhinosfootballacademy.com
jameskibbie.com
blood-sports.net
asiluxury.com
xltyu.com
vibethink.net
stupbratt.no
paymybill.guru
hkr-reise.de
polychromelabs.com
lloydconstruction.com
sagadc.com
antonmack.de
steampluscarpetandfloors.com
testcoreprohealthuk.com
kaotikkustomz.com
sevenadvertising.com
hhcourier.com
courteney-cox.net
123vrachi.ru
yourobgyn.net
blgr.be
mardenherefordshire-pc.gov.uk
maxadams.london
zervicethai.co.th
microcirc.net
sahalstore.com
pmc-services.de
pocket-opera.de
perbudget.com
atozdistribution.co.uk
socialonemedia.com
yousay.site
digivod.de
krlosdavid.com
hiddencitysecrets.com.au
stoneys.ch
desert-trails.com
echtveilig.nl
bigler-hrconsulting.ch
layrshift.eu
tux-espacios.com
castillobalduz.es
stemplusacademy.com
celularity.com
monark.com
jasonbaileystudio.com
glennroberts.co.nz
milltimber.aberdeen.sch.uk
sportsmassoren.com
autodemontagenijmegen.nl
fizzl.ru
modamilyon.com
wasmachtmeinfonds.at
imaginado.de
grelot-home.com
makeitcount.at
olejack.ru
bogdanpeptine.ro
jolly-events.com
koko-nora.dk
patrickfoundation.net
atalent.fi
comarenterprises.com
boisehosting.net
fundaciongregal.org
spinheal.ru
blacksirius.de
tetinfo.in
rostoncastings.co.uk
vihannesporssi.fi
smithmediastrategies.com
kenhnoithatgo.com
bimnapratica.com
atmos-show.com
upmrkt.co
centrospgolega.com
siliconbeach-realestate.com
iyahayki.nl
opatrovanie-ako.sk
mrsplans.net
completeweddingkansas.com
zflas.com
agence-chocolat-noir.com
smale-opticiens.nl
trackyourconstruction.com
fairfriends18.de
stallbyggen.se
streamerzradio1.site
conexa4papers.trade
philippedebroca.com
haar-spange.com
tarotdeseidel.com
nataschawessels.com
eglectonk.online
bowengroup.com.au
fransespiegels.nl
christ-michael.net
backstreetpub.com
wsoil.com.sg
handi-jack-llc.com
edrcreditservices.nl
newstap.com.ng
petnest.ir
milestoneshows.com
tinkoff-mobayl.ru
shadebarandgrillorlando.com
lorenacarnero.com
nurturingwisdom.com
camsadviser.com
plotlinecreative.com
gratispresent.se
lionware.de
videomarketing.pro
1kbk.com.ua
bayoga.co.uk
hairstylesnow.site
kostenlose-webcams.com
marchand-sloboda.com
calabasasdigest.com
nmiec.com
deschl.net
ncid.bc.ca
americafirstcommittee.org
kedak.de
dr-pipi.de
outcomeisincome.com
newyou.at
strategicstatements.com
miraclediet.fun
htchorst.nl
ventti.com.ar
boldcitydowntown.com
rebeccarisher.com
kalkulator-oszczednosci.pl
bxdf.info
tradiematepro.com.au
offroadbeasts.com
binder-buerotechnik.at
sexandfessenjoon.wordpress.com
maureenbreezedancetheater.org
torgbodenbollnas.se
madinblack.com
platformier.com
eaglemeetstiger.de
comparatif-lave-linge.fr
slupetzky.at
harpershologram.wordpress.com
calxplus.eu
classycurtainsltd.co.uk
evologic-technologies.com
hebkft.hu
stefanpasch.me
ostheimer.at
ora-it.de
rafaut.com
campusoutreach.org
jandaonline.com
ontrailsandboulevards.com
sandd.nl
jacquin-maquettes.com
xoabigail.com
polzine.net
baustb.de
malychanieruchomoscipremium.com
mylolis.com
kaminscy.com
micro-automation.de
bigbaguettes.eu
daklesa.de
humancondition.com
extensionmaison.info
abogadoengijon.es
morawe-krueger.de
all-turtles.com
botanicinnovations.com
pickanose.com
symphonyenvironmental.com
houseofplus.com
mbfagency.com
haremnick.com
thenewrejuveme.com
jvanvlietdichter.nl
imperfectstore.com
cwsitservices.co.uk
boompinoy.com
nvwoodwerks.com
saka.gr
insidegarage.pl
ymca-cw.org.uk
longislandelderlaw.com
nicoleaeschbachorg.wordpress.com
seproc.hn
allentownpapershow.com
greenpark.ch
liliesandbeauties.org
bouquet-de-roses.com
schoolofpassivewealth.com
pawsuppetlovers.com
seitzdruck.com
directwindowco.com
grupocarvalhoerodrigues.com.br
plastidip.com.ar
helikoptervluchtnewyork.nl
troegs.com
ilcdover.com
simoneblum.de
ruralarcoiris.com
norpol-yachting.com
hotelzentral.at
ianaswanson.com
the-domain-trader.com
mikeramirezcpa.com
kirkepartner.dk
ungsvenskarna.se
seagatesthreecharters.com
jeanlouissibomana.com
ki-lowroermond.nl
aco-media.nl
finediningweek.pl
extraordinaryoutdoors.com
servicegsm.net
artallnightdc.com
pierrehale.com
kath-kirche-gera.de
allure-cosmetics.at
carlosja.com
resortmtn.com
nacktfalter.de
stampagrafica.es
rehabilitationcentersinhouston.net
samnewbyjax.com
corendonhotels.com
lucidinvestbank.com
bptdmaluku.com
oceanastudios.com
controldekk.com
work2live.de
enovos.de
assurancesalextrespaille.fr
jiloc.com
eadsmurraypugh.com
schraven.de
candyhouseusa.com
flexicloud.hk
lenreactiv-shop.ru
destinationclients.fr
myhealth.net.au
saxtec.com
huehnerauge-entfernen.de
vanswigchemdesign.com
pier40forall.org
instatron.net
mariposapropaneaz.com
dw-css.de
balticdentists.com
carriagehousesalonvt.com
physiofischer.de
poultrypartners.nl
c-a.co.in
ino-professional.ru
vibehouse.rw
rollingrockcolumbia.com
seminoc.com
parkcf.nl
mountaintoptinyhomes.com
dezatec.es
readberserk.com
smart-light.co.uk
upplandsspar.se
ampisolabergeggi.it
satyayoga.de
abogadosadomicilio.es
kidbucketlist.com.au
ncs-graphic-studio.com
ftlc.es
ncuccr.org
manijaipur.com
marcuswhitten.site
bierensgebakkramen.nl
y-archive.com
mindpackstudios.com
refluxreducer.com
sofavietxinh.com
sweering.fr
aniblinova.wordpress.com
faroairporttransfers.net
consultaractadenacimiento.com
crosspointefellowship.church
apolomarcas.com
-
net
true
-
pid
$2a$12$vdqTdjoXfyV.wBOEx9g4ZOFEY483G1yccC4Z7M8GlMP7FMtV5yWcm
-
prc
encsvc
powerpnt
xfssvccon
oracle
thebat
ocssd
sql
msaccess
mydesktopservice
visio
winword
dbeng50
ocomm
mspub
isqlplussvc
infopath
ocautoupds
tbirdconfig
synctime
agntsvc
wordpad
firefox
thunderbird
onenote
dbsnmp
excel
sqbcoreservice
steam
mydesktopqos
outlook
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
7598
-
svc
backup
svc$
veeam
sophos
sql
mepocs
vss
memtas
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
suricata: ET MALWARE Known Sinkhole Response Header
suricata: ET MALWARE Known Sinkhole Response Header
-
Blocklisted process makes network request 64 IoCs
Processes:
rundll32.exeflow pid process 15 3128 rundll32.exe 17 3128 rundll32.exe 19 3128 rundll32.exe 21 3128 rundll32.exe 23 3128 rundll32.exe 25 3128 rundll32.exe 27 3128 rundll32.exe 29 3128 rundll32.exe 31 3128 rundll32.exe 33 3128 rundll32.exe 36 3128 rundll32.exe 38 3128 rundll32.exe 40 3128 rundll32.exe 42 3128 rundll32.exe 44 3128 rundll32.exe 47 3128 rundll32.exe 49 3128 rundll32.exe 51 3128 rundll32.exe 53 3128 rundll32.exe 55 3128 rundll32.exe 57 3128 rundll32.exe 59 3128 rundll32.exe 61 3128 rundll32.exe 63 3128 rundll32.exe 65 3128 rundll32.exe 67 3128 rundll32.exe 69 3128 rundll32.exe 71 3128 rundll32.exe 72 3128 rundll32.exe 73 3128 rundll32.exe 74 3128 rundll32.exe 76 3128 rundll32.exe 77 3128 rundll32.exe 78 3128 rundll32.exe 79 3128 rundll32.exe 81 3128 rundll32.exe 83 3128 rundll32.exe 85 3128 rundll32.exe 87 3128 rundll32.exe 89 3128 rundll32.exe 92 3128 rundll32.exe 94 3128 rundll32.exe 96 3128 rundll32.exe 98 3128 rundll32.exe 100 3128 rundll32.exe 102 3128 rundll32.exe 104 3128 rundll32.exe 106 3128 rundll32.exe 108 3128 rundll32.exe 110 3128 rundll32.exe 112 3128 rundll32.exe 114 3128 rundll32.exe 117 3128 rundll32.exe 119 3128 rundll32.exe 121 3128 rundll32.exe 122 3128 rundll32.exe 123 3128 rundll32.exe 124 3128 rundll32.exe 126 3128 rundll32.exe 128 3128 rundll32.exe 130 3128 rundll32.exe 132 3128 rundll32.exe 134 3128 rundll32.exe 136 3128 rundll32.exe -
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
rundll32.exedescription ioc process File renamed C:\Users\Admin\Pictures\RedoRemove.tiff => \??\c:\users\admin\pictures\RedoRemove.tiff.vwt3rqqt rundll32.exe File renamed C:\Users\Admin\Pictures\RepairResize.tif => \??\c:\users\admin\pictures\RepairResize.tif.vwt3rqqt rundll32.exe File renamed C:\Users\Admin\Pictures\ResizeUndo.crw => \??\c:\users\admin\pictures\ResizeUndo.crw.vwt3rqqt rundll32.exe File renamed C:\Users\Admin\Pictures\ResolveCheckpoint.png => \??\c:\users\admin\pictures\ResolveCheckpoint.png.vwt3rqqt rundll32.exe File renamed C:\Users\Admin\Pictures\AssertSave.tif => \??\c:\users\admin\pictures\AssertSave.tif.vwt3rqqt rundll32.exe File opened for modification \??\c:\users\admin\pictures\GrantSplit.tiff rundll32.exe File renamed C:\Users\Admin\Pictures\GrantSplit.tiff => \??\c:\users\admin\pictures\GrantSplit.tiff.vwt3rqqt rundll32.exe File renamed C:\Users\Admin\Pictures\MountSplit.tif => \??\c:\users\admin\pictures\MountSplit.tif.vwt3rqqt rundll32.exe File renamed C:\Users\Admin\Pictures\OutRead.crw => \??\c:\users\admin\pictures\OutRead.crw.vwt3rqqt rundll32.exe File opened for modification \??\c:\users\admin\pictures\RedoRemove.tiff rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\zQS1XtGvA8 = "C:\\Windows\\SysWOW64\\rundll32.exe" rundll32.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
rundll32.exedescription ioc process File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\U: rundll32.exe File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\E: rundll32.exe File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\D: rundll32.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\P: rundll32.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\V: rundll32.exe File opened (read-only) \??\Z: rundll32.exe File opened (read-only) \??\B: rundll32.exe File opened (read-only) \??\F: rundll32.exe File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\T: rundll32.exe File opened (read-only) \??\A: rundll32.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\M: rundll32.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\14e8vqc5n78.bmp" rundll32.exe -
Drops file in Program Files directory 20 IoCs
Processes:
rundll32.exedescription ioc process File created \??\c:\program files\vwt3rqqt-readme.txt rundll32.exe File opened for modification \??\c:\program files\CloseSelect.wmf rundll32.exe File opened for modification \??\c:\program files\DisableSend.vsw rundll32.exe File opened for modification \??\c:\program files\ExportStop.jpg rundll32.exe File opened for modification \??\c:\program files\MoveDismount.DVR rundll32.exe File opened for modification \??\c:\program files\OpenFind.js rundll32.exe File opened for modification \??\c:\program files\RevokeAssert.pdf rundll32.exe File opened for modification \??\c:\program files\ApproveConvertFrom.ppt rundll32.exe File opened for modification \??\c:\program files\RevokeProtect.vssm rundll32.exe File opened for modification \??\c:\program files\RevokeUnpublish.jfif rundll32.exe File opened for modification \??\c:\program files\TraceStop.aif rundll32.exe File opened for modification \??\c:\program files\ConvertToOpen.crw rundll32.exe File opened for modification \??\c:\program files\EditDisconnect.tiff rundll32.exe File opened for modification \??\c:\program files\GroupSave.ppsm rundll32.exe File opened for modification \??\c:\program files\LimitFormat.xml rundll32.exe File opened for modification \??\c:\program files\ReadAdd.doc rundll32.exe File opened for modification \??\c:\program files\ReadGroup.htm rundll32.exe File created \??\c:\program files (x86)\vwt3rqqt-readme.txt rundll32.exe File opened for modification \??\c:\program files\LockFind.xls rundll32.exe File opened for modification \??\c:\program files\UpdateExport.xltx rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
rundll32.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\SystemCertificates\CA\Certificates\2F7AA2D86056A8775796F798C481A079E538E004\Blob = 0300000001000000140000002f7aa2d86056a8775796f798c481a079e538e00414000000010000001400000012c9889b2fc9447a7d12f1df4003429892c724d6040000000100000010000000249f06a9652b2112fc4d7368e6372fec0f00000001000000200000008929be84b4db8bea07b5a70b3bc65a39b1e9b28722689c21893afae875b2ed0c190000000100000010000000d0e6e37d30133bf9aa9f1b76135668425c0000000100000004000000000800001800000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000550500003082055130820439a00302010202100c08966535b942a9735265e4f97540bc300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3230303731363132323134345a170d3233303533313233353935395a3059310b300906035504061302555331153013060355040a130c446967694365727420496e63313330310603550403132a47656f547275737420544c5320445620525341204d697865642053484132353620323032302043412d3130820122300d06092a864886f70d01010105000382010f003082010a0282010100b3bd41fb6be6dfa251bf541463c675a651eee388a73a78a09b9e5b917ca5a85933fac66c0750339979fa53f1cc16dde5a69961d34da2ef939402e4c4c95f97d11a6e09da34540bb238c6dd4dad717dbade9bedcb49a04bc363a77f3364b7c7ba7673d21b5286ae9c12e4e7a0ab7cf3efaad5da852308682b1c78e69bafb466fe47d5c18b632c5ccc02f211ded0e9a40c8db9f99accebcc83ab5d84e0aaed19df8f3b553a43b65c114e5af431b6eabd646858109966b2bef39f1a858312a8d7025fec271e6fdf8f80c747edde4b33d31f78b4193b8b13d5f35af35373dd9429245b6d5916cf01c92eeb50450e99f9b6de4527a45e306f8fc3cd4767082d3188c90203010001a382020b30820207301d0603551d0e0416041412c9889b2fc9447a7d12f1df4003429892c724d6301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b0601050507030230120603551d130101ff040830060101ff020100303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63726c3081ce0603551d200481c63081c33081c00604551d20003081b7302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f43505330818a06082b06010505070202307e0c7c416e7920757365206f66207468697320436572746966696361746520636f6e737469747574657320616363657074616e6365206f66207468652052656c79696e672050617274792041677265656d656e74206c6f63617465642061742068747470733a2f2f7777772e64696769636572742e636f6d2f7270612d7561300d06092a864886f70d01010b050003820101007f4bfc33ba6545c2d8416b8e48ab3c02c8fa11b0e61e714ecc57f7b57473f922b366d3ab97940b27c90eec681a72450ba8875a14c4ba8b178db3b1a576074a0e9852b0f602ab8596ff420ac2f3af50013dc6c7f5834b4ce2c7e300d4df3861f3e914914b7882cca69e7ab2a63afa90f80529512072cc4abd23ec3c6bcb586b2724562ddedc1ebb3bbaa1e7560a02812847f57b2dcb9d13b87959eb40799ae97afc6ef9fa9a410b3b667b87334029f321c619ffc944f5949ff11467e87c13d6bd2313cd2b27d5fe8bba6df3ea58bc17acd14e993c89c12aed7f96c04284c91c31cb3347a1e5f69539909df5aa2b56a10b4df2f54fcd48118e88aec57257a53d12 rundll32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85A408C09C193E5D51587DCDD61330FD8CDE37BF\Blob = 0f0000000100000014000000ff99b1116eca7b69f516900dea2d12202453b5110b0000000100000036000000440065007500740073006300680065002000540065006c0065006b006f006d00200052006f006f007400200043004100200032000000620000000100000020000000b6191a50d0c3977f7da99bcdaac86a227daeb9679ec70ba3b0c9d92271c170d3090000000100000020000000301e06082b0601050507030206082b0601050507030406082b0601050507030114000000010000001400000031c3791bbaf553d717e0897a2d176c0ab32b9d331d000000010000001000000048c1184e28125121aeeef1a32ce0d4677e0000000100000008000000000063f58926d70103000000010000001400000085a408c09c193e5d51587dcdd61330fd8cde37bf2000000001000000a30300003082039f30820287a003020102020126300d06092a864886f70d01010505003071310b3009060355040613024445311c301a060355040a131344657574736368652054656c656b6f6d204147311f301d060355040b1316542d54656c655365632054727573742043656e746572312330210603550403131a44657574736368652054656c656b6f6d20526f6f742043412032301e170d3939303730393132313130305a170d3139303730393233353930305a3071310b3009060355040613024445311c301a060355040a131344657574736368652054656c656b6f6d204147311f301d060355040b1316542d54656c655365632054727573742043656e746572312330210603550403131a44657574736368652054656c656b6f6d20526f6f74204341203230820122300d06092a864886f70d01010105000382010f003082010a0282010100ab0ba335e08b2914b11485af3c10e4396f355d4aaeddea618d9549f46f64a31a6066a4a9402284d9d4a5e578930e6801adb94d5c3aced3b8a84240dfcfa3ba82596a921bac1c9ada082b2527f9692347f1e0eb2c7a9bf51302d07e347cc29e3c0059abf5da0cf5323c2bac50dad6c3de8394caa80c99320e0848565b6afbdae1585801495f72413c1506018e5dadaab893b4cd9eeba7e86a2d5234db3aef5c7551dadbf331f9ee719832c45415440cf99b55edaddf1808a0a3868a49ee53058f194cd5de58799bd26a1c42abc5d5a7cf680f96e4e161987661c8917cd63e00e2915087e19d0ae6ad97d21dc63a7dcbbcda0334d58e5b01f56a07b716b66e4a7f0203010001a3423040301d0603551d0e0416041431c3791bbaf553d717e0897a2d176c0ab32b9d33300f0603551d13040830060101ff020105300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100946459ad3964e729eb13fe5ac38b1357c80424f07477c060e367fbe989a683bf96827c6ed4c33def9e806ebb29b4987ab13b54eb3917477e1a8e0bfc1f31593104b2ce17f32cc7623655e222d88955b49848aa64fad61c36d844785a5a233a5797f57a304fae9f6a4c4b2b8ea003e33ee0a9d4d27bd2b3a8e2723cad9eff8059e49b45b4f63bb0cd39199832e5ea216190e431218e34b1f72f354a8510dae78a3721be5963e0f285883153d45414857079f42e067727752f1fb88af9fec5bad836e483ece765b7bf635af346af819437d4418cd623d61ecff5681b4463a25abaa73559a1e570059b0e235799940a6dba3963288692f31884d8fbd1cf05566457 rundll32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85A408C09C193E5D51587DCDD61330FD8CDE37BF\Blob = 04000000010000001000000074014a91b108c458ce47cdf0dd11530803000000010000001400000085a408c09c193e5d51587dcdd61330fd8cde37bf7e0000000100000008000000000063f58926d7011d000000010000001000000048c1184e28125121aeeef1a32ce0d46714000000010000001400000031c3791bbaf553d717e0897a2d176c0ab32b9d33090000000100000020000000301e06082b0601050507030206082b0601050507030406082b06010505070301620000000100000020000000b6191a50d0c3977f7da99bcdaac86a227daeb9679ec70ba3b0c9d92271c170d30b0000000100000036000000440065007500740073006300680065002000540065006c0065006b006f006d00200052006f006f0074002000430041002000320000000f0000000100000014000000ff99b1116eca7b69f516900dea2d12202453b5112000000001000000a30300003082039f30820287a003020102020126300d06092a864886f70d01010505003071310b3009060355040613024445311c301a060355040a131344657574736368652054656c656b6f6d204147311f301d060355040b1316542d54656c655365632054727573742043656e746572312330210603550403131a44657574736368652054656c656b6f6d20526f6f742043412032301e170d3939303730393132313130305a170d3139303730393233353930305a3071310b3009060355040613024445311c301a060355040a131344657574736368652054656c656b6f6d204147311f301d060355040b1316542d54656c655365632054727573742043656e746572312330210603550403131a44657574736368652054656c656b6f6d20526f6f74204341203230820122300d06092a864886f70d01010105000382010f003082010a0282010100ab0ba335e08b2914b11485af3c10e4396f355d4aaeddea618d9549f46f64a31a6066a4a9402284d9d4a5e578930e6801adb94d5c3aced3b8a84240dfcfa3ba82596a921bac1c9ada082b2527f9692347f1e0eb2c7a9bf51302d07e347cc29e3c0059abf5da0cf5323c2bac50dad6c3de8394caa80c99320e0848565b6afbdae1585801495f72413c1506018e5dadaab893b4cd9eeba7e86a2d5234db3aef5c7551dadbf331f9ee719832c45415440cf99b55edaddf1808a0a3868a49ee53058f194cd5de58799bd26a1c42abc5d5a7cf680f96e4e161987661c8917cd63e00e2915087e19d0ae6ad97d21dc63a7dcbbcda0334d58e5b01f56a07b716b66e4a7f0203010001a3423040301d0603551d0e0416041431c3791bbaf553d717e0897a2d176c0ab32b9d33300f0603551d13040830060101ff020105300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100946459ad3964e729eb13fe5ac38b1357c80424f07477c060e367fbe989a683bf96827c6ed4c33def9e806ebb29b4987ab13b54eb3917477e1a8e0bfc1f31593104b2ce17f32cc7623655e222d88955b49848aa64fad61c36d844785a5a233a5797f57a304fae9f6a4c4b2b8ea003e33ee0a9d4d27bd2b3a8e2723cad9eff8059e49b45b4f63bb0cd39199832e5ea216190e431218e34b1f72f354a8510dae78a3721be5963e0f285883153d45414857079f42e067727752f1fb88af9fec5bad836e483ece765b7bf635af346af819437d4418cd623d61ecff5681b4463a25abaa73559a1e570059b0e235799940a6dba3963288692f31884d8fbd1cf05566457 rundll32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85A408C09C193E5D51587DCDD61330FD8CDE37BF\Blob = 5c00000001000000040000000008000004000000010000001000000074014a91b108c458ce47cdf0dd11530803000000010000001400000085a408c09c193e5d51587dcdd61330fd8cde37bf7e0000000100000008000000000063f58926d7011d000000010000001000000048c1184e28125121aeeef1a32ce0d46714000000010000001400000031c3791bbaf553d717e0897a2d176c0ab32b9d33090000000100000020000000301e06082b0601050507030206082b0601050507030406082b06010505070301620000000100000020000000b6191a50d0c3977f7da99bcdaac86a227daeb9679ec70ba3b0c9d92271c170d30b0000000100000036000000440065007500740073006300680065002000540065006c0065006b006f006d00200052006f006f0074002000430041002000320000000f0000000100000014000000ff99b1116eca7b69f516900dea2d12202453b5111900000001000000100000000790dd35d0de1a5516689a62748c58eb2000000001000000a30300003082039f30820287a003020102020126300d06092a864886f70d01010505003071310b3009060355040613024445311c301a060355040a131344657574736368652054656c656b6f6d204147311f301d060355040b1316542d54656c655365632054727573742043656e746572312330210603550403131a44657574736368652054656c656b6f6d20526f6f742043412032301e170d3939303730393132313130305a170d3139303730393233353930305a3071310b3009060355040613024445311c301a060355040a131344657574736368652054656c656b6f6d204147311f301d060355040b1316542d54656c655365632054727573742043656e746572312330210603550403131a44657574736368652054656c656b6f6d20526f6f74204341203230820122300d06092a864886f70d01010105000382010f003082010a0282010100ab0ba335e08b2914b11485af3c10e4396f355d4aaeddea618d9549f46f64a31a6066a4a9402284d9d4a5e578930e6801adb94d5c3aced3b8a84240dfcfa3ba82596a921bac1c9ada082b2527f9692347f1e0eb2c7a9bf51302d07e347cc29e3c0059abf5da0cf5323c2bac50dad6c3de8394caa80c99320e0848565b6afbdae1585801495f72413c1506018e5dadaab893b4cd9eeba7e86a2d5234db3aef5c7551dadbf331f9ee719832c45415440cf99b55edaddf1808a0a3868a49ee53058f194cd5de58799bd26a1c42abc5d5a7cf680f96e4e161987661c8917cd63e00e2915087e19d0ae6ad97d21dc63a7dcbbcda0334d58e5b01f56a07b716b66e4a7f0203010001a3423040301d0603551d0e0416041431c3791bbaf553d717e0897a2d176c0ab32b9d33300f0603551d13040830060101ff020105300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100946459ad3964e729eb13fe5ac38b1357c80424f07477c060e367fbe989a683bf96827c6ed4c33def9e806ebb29b4987ab13b54eb3917477e1a8e0bfc1f31593104b2ce17f32cc7623655e222d88955b49848aa64fad61c36d844785a5a233a5797f57a304fae9f6a4c4b2b8ea003e33ee0a9d4d27bd2b3a8e2723cad9eff8059e49b45b4f63bb0cd39199832e5ea216190e431218e34b1f72f354a8510dae78a3721be5963e0f285883153d45414857079f42e067727752f1fb88af9fec5bad836e483ece765b7bf635af346af819437d4418cd623d61ecff5681b4463a25abaa73559a1e570059b0e235799940a6dba3963288692f31884d8fbd1cf05566457 rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\SystemCertificates\CA\Certificates\33E4E80807204C2B6182A3A14B591ACD25B5F0DB\Blob = 03000000010000001400000033e4e80807204c2b6182a3a14b591acd25b5f0db1400000001000000140000008d8c5ec454ad8ae177e99bf99b05e1b8018d61e1040000000100000010000000adab5c4df031fb9299f71ada7e18f6130f00000001000000300000008b612b2190a95b28b866b9be5d0b95f368c17534ab1da61a42dfb32766f9ae2908fe6bfd1669be140eddaf0d33e95235190000000100000010000000fc741b3b78cfb31e075744fe5d0eeb965c000000010000000400000000080000180000000100000010000000ea6089055218053dd01e37e1d806eedf20000000010000001706000030820613308203fba00302010202107d5b5126b476ba11db74160bbc530da7300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3138313130323030303030305a170d3330313233313233353935395a30818f310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f726431183016060355040a130f5365637469676f204c696d69746564313730350603550403132e5365637469676f2052534120446f6d61696e2056616c69646174696f6e205365637572652053657276657220434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d67333d6d73c20d000d21745b8d63e07a23fc741ee3230c9b06cfdf49fcb12980f2d3f8d4d010c820f177f622ee9b84879fb16834eadd7322593b707bfb9503fa94cc3402ae939ffd981ca1f163241da8026b9237a87201ee3ff209a3c95446f8775069040b4329316091008233ed2dd870f6f5d51146a0a69c54f017269cfd3934c6d04a0a31b827eb19ab9edc59ec537789f9a0834fb562e58c4090e06645bbc37dcf19f2868a856b092a35c9fbb8898081b241dab3085aeafb02e9e7a9dc1c0421ce202f0eae04ad2ef900eb4c14016f06f85424a64f7a430a0febf2ea3275a8e8b58b8adc319178463ed6f56fd83cb6034c474bee69ddbe1e4e5ca0c5f150203010001a382016e3082016a301f0603551d230418301680145379bf5aaa2b4acf5480e1d89bc09df2b20366cb301d0603551d0e041604148d8c5ec454ad8ae177e99bf99b05e1b8018d61e1300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b06010505070302301b0603551d200414301230060604551d20003008060667810c01020130500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737452534143657274696669636174696f6e417574686f726974792e63726c307606082b06010505070101046a3068303f06082b060105050730028633687474703a2f2f6372742e7573657274727573742e636f6d2f555345525472757374525341416464547275737443412e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d01010c0500038202010032bf61bd0e48c34fc7ba474df89c781901dc131d806ffcc370b4529a31339a5752fb319e6ba4ef54aa898d401768f811107cd2cab1f15586c7eeb3369186f63951bf46bf0fa0bab4f77e49c42a36179ee468397aaf944e566fb27b3bbf0a86bdcdc5771c03b838b1a21f5f7edb8adc4648b6680acfb2b5b4e234e467a93866095ed2b8fc9d283a174027c2724e29fd213c7ccf13fb962cc53144fd13edd59ba96968777ceee1ffa4f93638085339a284349c19f3be0eacd52437eb23a878d0d3e7ef924764623922efc6f711be2285c6664424268e10328dc893ae079e833e2fd9f9f5468e63bec1e6b4dca6cd21a8860a95d92e85261afdfcb1b657426d95d133f6391406824138f58f58dc805ba4d57d9578fda79bfffdc5a869ab26e7a7a405875ba9b7b8a3200b97a94585ddb38be589378e290dfc0617f638400e42e41206fb7bf3c6116862dfe398f413d8154f8bb169d91060bc642aea31b7e4b5a33a149b26e30b7bfd028eb699c138975936f6a874a286b65eebc664eacfa0a3f96e9eba2d11b6869808582dc9ac2564f25e75b438c1ae7f5a4683ea51cab6f19911356ba56a7bc600b0e7f8be64b2adc8c2f1ace351eaa493e079c8e18140c90a5be1123cc1602ae397c08942ca94cf46981269bb98d0c2d30d724b476ee593c43228638743e4b0323e0ad34bbf239b1429412b9a041f932df1c739483cad5a127f rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85A408C09C193E5D51587DCDD61330FD8CDE37BF rundll32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\85A408C09C193E5D51587DCDD61330FD8CDE37BF\Blob = 1900000001000000100000000790dd35d0de1a5516689a62748c58eb0f0000000100000014000000ff99b1116eca7b69f516900dea2d12202453b5110b0000000100000036000000440065007500740073006300680065002000540065006c0065006b006f006d00200052006f006f007400200043004100200032000000620000000100000020000000b6191a50d0c3977f7da99bcdaac86a227daeb9679ec70ba3b0c9d92271c170d3090000000100000020000000301e06082b0601050507030206082b0601050507030406082b0601050507030114000000010000001400000031c3791bbaf553d717e0897a2d176c0ab32b9d331d000000010000001000000048c1184e28125121aeeef1a32ce0d4677e0000000100000008000000000063f58926d70103000000010000001400000085a408c09c193e5d51587dcdd61330fd8cde37bf04000000010000001000000074014a91b108c458ce47cdf0dd1153082000000001000000a30300003082039f30820287a003020102020126300d06092a864886f70d01010505003071310b3009060355040613024445311c301a060355040a131344657574736368652054656c656b6f6d204147311f301d060355040b1316542d54656c655365632054727573742043656e746572312330210603550403131a44657574736368652054656c656b6f6d20526f6f742043412032301e170d3939303730393132313130305a170d3139303730393233353930305a3071310b3009060355040613024445311c301a060355040a131344657574736368652054656c656b6f6d204147311f301d060355040b1316542d54656c655365632054727573742043656e746572312330210603550403131a44657574736368652054656c656b6f6d20526f6f74204341203230820122300d06092a864886f70d01010105000382010f003082010a0282010100ab0ba335e08b2914b11485af3c10e4396f355d4aaeddea618d9549f46f64a31a6066a4a9402284d9d4a5e578930e6801adb94d5c3aced3b8a84240dfcfa3ba82596a921bac1c9ada082b2527f9692347f1e0eb2c7a9bf51302d07e347cc29e3c0059abf5da0cf5323c2bac50dad6c3de8394caa80c99320e0848565b6afbdae1585801495f72413c1506018e5dadaab893b4cd9eeba7e86a2d5234db3aef5c7551dadbf331f9ee719832c45415440cf99b55edaddf1808a0a3868a49ee53058f194cd5de58799bd26a1c42abc5d5a7cf680f96e4e161987661c8917cd63e00e2915087e19d0ae6ad97d21dc63a7dcbbcda0334d58e5b01f56a07b716b66e4a7f0203010001a3423040301d0603551d0e0416041431c3791bbaf553d717e0897a2d176c0ab32b9d33300f0603551d13040830060101ff020105300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100946459ad3964e729eb13fe5ac38b1357c80424f07477c060e367fbe989a683bf96827c6ed4c33def9e806ebb29b4987ab13b54eb3917477e1a8e0bfc1f31593104b2ce17f32cc7623655e222d88955b49848aa64fad61c36d844785a5a233a5797f57a304fae9f6a4c4b2b8ea003e33ee0a9d4d27bd2b3a8e2723cad9eff8059e49b45b4f63bb0cd39199832e5ea216190e431218e34b1f72f354a8510dae78a3721be5963e0f285883153d45414857079f42e067727752f1fb88af9fec5bad836e483ece765b7bf635af346af819437d4418cd623d61ecff5681b4463a25abaa73559a1e570059b0e235799940a6dba3963288692f31884d8fbd1cf05566457 rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\SystemCertificates\CA\Certificates\33E4E80807204C2B6182A3A14B591ACD25B5F0DB rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\SystemCertificates\CA\Certificates\2F7AA2D86056A8775796F798C481A079E538E004 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
rundll32.exepid process 3128 rundll32.exe 3128 rundll32.exe 3128 rundll32.exe 3128 rundll32.exe 3128 rundll32.exe 3128 rundll32.exe 3128 rundll32.exe 3128 rundll32.exe 3128 rundll32.exe 3128 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
rundll32.exevssvc.exedescription pid process Token: SeDebugPrivilege 3128 rundll32.exe Token: SeTakeOwnershipPrivilege 3128 rundll32.exe Token: SeBackupPrivilege 3388 vssvc.exe Token: SeRestorePrivilege 3388 vssvc.exe Token: SeAuditPrivilege 3388 vssvc.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1624 wrote to memory of 3128 1624 rundll32.exe rundll32.exe PID 1624 wrote to memory of 3128 1624 rundll32.exe rundll32.exe PID 1624 wrote to memory of 3128 1624 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d8353cfc5e696d3ae402c7c70565c1e7f31e49bcf74a6e12e5ab044f306b4b20.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d8353cfc5e696d3ae402c7c70565c1e7f31e49bcf74a6e12e5ab044f306b4b20.dll,#12⤵
- Blocklisted process makes network request
- Modifies extensions of user files
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3128
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:1136
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3388