sodinokibi | aa0b989579334c305be234de57baa8ffcd7f9e11077820199e58b71bd851c729

General

Target

aa0b989579334c305be234de57baa8ffcd7f9e11077820199e58b71bd851c729.dll
Size

1005KB
MD5

650dd09b5077b157727868148ddb3307
SHA1

67c6b2344e9f13eeef5969979a58e999f2f09542
SHA256

aa0b989579334c305be234de57baa8ffcd7f9e11077820199e58b71bd851c729
SHA512

dfcfcd5fc543291a1ea56f6ef82fb98d7c0269bc9be4bfb338aefe08afe700e0b055ac3a82d1426defa53cb1cd63cb46ef9972da776b2c10104293926365b5c8
SSDEEP

24576:R54YNXJJPMNYGBVsWpZW7Qy8G0DpmAU8wKwTDS:R3JPMNrH40D9hwKWS

Score

10^/10

sodinokibi $2a$12$sksv8rkaimriiv.rk505voobpuyzqggekvc11la6kwdqcxenhkyjk 7595 ransomware spyware stealer

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$12$SKsv8RkaiMRiIv.rk505vOoBpUyZQgGeKVc11LA6kWdQcxENhkyjK

Campaign

7595

Decoy

hiddencitysecrets.com.au

groupe-frayssinet.fr

rimborsobancario.net

vietlawconsultancy.com

live-your-life.jp

verbisonline.com

sachnendoc.com

htchorst.nl

bridgeloanslenders.com

petnest.ir

myhealth.net.au

gopackapp.com

jenniferandersonwriter.com

logopaedie-blomberg.de

osterberg.fi

bierensgebakkramen.nl

refluxreducer.com

thenewrejuveme.com

alvinschwartz.wordpress.com

leoben.at

Attributes

net
true
pid
$2a$12$SKsv8RkaiMRiIv.rk505vOoBpUyZQgGeKVc11LA6kWdQcxENhkyjK
prc
firefox
mydesktopservice
xfssvccon
infopath
visio
encsvc
onenote
ocssd
ocautoupds
excel
agntsvc
outlook
mspub
iconcerto
wordpad
sqbcoreservice
winword
oracle
thunderbird
ocomm
mydesktopqos
steam
dbsnmp
sql
synctime
tbirdconfig
dbeng50
isqlplussvc
msaccess
thebat
powerpnt
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
sub
7595
svc
memtas
veeam
sophos
sql
vss
svc$
mepocs
backup

Extracted

Path

C:\Recovery\wl8ptg587-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension wl8ptg587. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B078344D473F8790 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/B078344D473F8790 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: JuOxdzYS6faZHlP8MhBiNUSdH8M9HUZ2DshVi8IrygQrrj/RLv4jVVK1GznEU6WQ zYW10o40fCbn4ZWDao5XJhs+8mKJGSip3sB61ApoUV6KDvd2f1pBQtIsWPrUDe44 iRrG7QgweBYvljls3esyH1tNEZV+LEDLS0xxszk4B8hq62rLlMcWj87DPIENJ0Mu jwBn65uVO155BAqps9UYrAgdjYNORad7m2URnH8rCPAELLlbr+IEV05pnE6jNR/w 0N+GQij1KA/j1Fg5mf3U0S7cbSCzfPTThryBEW+dvxsdEEymbW0en5NqhnyIEsrc hz/kYIYXis89YWx/hTD5CQn/AH0hxRsykKs3UR8c250WvOGxu/CGJSdTjEWyYTHL 3cF9xYAICnin8wlS1jBERmP5EsCTRATlpKz0GFRTJzQBg6C3fWaz2N6fmE2aGo6E pkDSmmyx6w56KcDoXmj5CSStdw1uRmtEs0scgCXD8FeUPsEN9TIAiybVGVbVpuw9 UnucrhGAEFobeN4MHkDp0ELaIJtYnC31kvZlqH8IINYvh5amIMJZUPMZs73SdvEk xJREWiVq7iHzKRuY1bQODi9esnhkI4OYFG4jq2K7pg1t0GfNkVCGjn2ZZUZaOq4K a/X1dGttz+NKrw+x63QGSnJLpOupZyuzJei2BE/UFh5PmNfVmb4DFg/y0FrHoxQL I6SHjxhaNVdguczbx53QAIu/cy/KVccrD5fgPhghcFcPHHx/OrEHE+VWZV8VmCjr NnZ65/kv5lxK05964BhThVS/OwseKgprbME5hPP3XaeaetLLnwNwaZ7f5KY27PzF OgQ3PD4LDfFeeTowyQF1dw9lubf1z/dHs1U95bf91HSGs/GSPKXk+WkZzaTNCqx9 PJiLlkmf00YS/lLW0lGp9FaQRzHhQmiz7NEHeF5pLzA7e3ZM1vxgYw74tEcz7PaO UsLXkzpGbWIE0bkwzoY0u1LvaRgKz2moodVxZX/9ckHwC0kTw2SNnsmQxuS950Ev aItLrO/rXlKJDa4f32qxV2LoPoscdDyyPnmiTaJEYifrKHagC3YuZo3DRv+uhE9s fk0hlRzbvLaaCab7aSKFYEnayLWoDWm842VvG1dUIQDwFeUP3EFvpnk9Koc1iJpl 9mFpa2GWjYqhtKWSg0jAdyt5rBMdg7mBjn3kxE3UUTWRUKzdVVZv2ftmv3bt4j2K 8isX3rEYctVJhyEOV5M3VVeHTFYdRJklkf6TH8EzxerRI5E8NWXbCdVscSesHN99 BaMHD7Y5RCFHc8tsxclLPpDOj5XbrYC+i6qS1qQqy34xHZYAV8lrc5xFS/H1EDhQ fCVU0l/ibUxokCngq+XSqEa5FobhTIWF3c82ow== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B078344D473F8790

http://decoder.re/B078344D473F8790

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Blocklisted process makes network request 64 IoCs

Processes:

rundll32.exe

flow	pid	process
4	2948	rundll32.exe
5	2948	rundll32.exe
7	2948	rundll32.exe
8	2948	rundll32.exe
11	2948	rundll32.exe
12	2948	rundll32.exe
14	2948	rundll32.exe
15	2948	rundll32.exe
18	2948	rundll32.exe
19	2948	rundll32.exe
21	2948	rundll32.exe
22	2948	rundll32.exe
24	2948	rundll32.exe
25	2948	rundll32.exe
27	2948	rundll32.exe
28	2948	rundll32.exe
30	2948	rundll32.exe
31	2948	rundll32.exe
34	2948	rundll32.exe
35	2948	rundll32.exe
37	2948	rundll32.exe
39	2948	rundll32.exe
40	2948	rundll32.exe
42	2948	rundll32.exe
43	2948	rundll32.exe
45	2948	rundll32.exe
46	2948	rundll32.exe
49	2948	rundll32.exe
54	2948	rundll32.exe
55	2948	rundll32.exe
57	2948	rundll32.exe
59	2948	rundll32.exe
62	2948	rundll32.exe
64	2948	rundll32.exe
66	2948	rundll32.exe
67	2948	rundll32.exe
69	2948	rundll32.exe
72	2948	rundll32.exe
73	2948	rundll32.exe
75	2948	rundll32.exe
77	2948	rundll32.exe
78	2948	rundll32.exe
80	2948	rundll32.exe
81	2948	rundll32.exe
83	2948	rundll32.exe
84	2948	rundll32.exe
87	2948	rundll32.exe
89	2948	rundll32.exe
90	2948	rundll32.exe
93	2948	rundll32.exe
94	2948	rundll32.exe
99	2948	rundll32.exe
101	2948	rundll32.exe
102	2948	rundll32.exe
104	2948	rundll32.exe
105	2948	rundll32.exe
108	2948	rundll32.exe
109	2948	rundll32.exe
112	2948	rundll32.exe
113	2948	rundll32.exe
115	2948	rundll32.exe
117	2948	rundll32.exe
119	2948	rundll32.exe
120	2948	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
File opened (read-only)	\??\A:	rundll32.exe
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\X:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe
File opened (read-only)	\??\D:	rundll32.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\E:	rundll32.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\B:	rundll32.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\R:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\P:	rundll32.exe
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\U:	rundll32.exe
File opened (read-only)	\??\M:	rundll32.exe
File opened (read-only)	\??\Q:	rundll32.exe
File opened (read-only)	\??\F:	rundll32.exe
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\W:	rundll32.exe

Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File opened for modification C:\Windows\System32\CatRoot2\dberr.txt rundll32.exe

description	ioc	process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	rundll32.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ike25c99ifycp.bmp"	rundll32.exe

Drops file in Program Files directory 35 IoCs

Processes:

rundll32.exe

description	ioc	process
File opened for modification	\??\c:\program files\DisableConvertFrom.rar	rundll32.exe
File opened for modification	\??\c:\program files\FindFormat.m3u	rundll32.exe
File opened for modification	\??\c:\program files\SelectClear.vbe	rundll32.exe
File opened for modification	\??\c:\program files\UnprotectWatch.TTS	rundll32.exe
File opened for modification	\??\c:\program files\UpdateRedo.dwfx	rundll32.exe
File opened for modification	\??\c:\program files\CloseUpdate.potm	rundll32.exe
File opened for modification	\??\c:\program files\PopReceive.txt	rundll32.exe
File opened for modification	\??\c:\program files\ResumeHide.rtf	rundll32.exe
File opened for modification	\??\c:\program files\CopyRedo.i64	rundll32.exe
File opened for modification	\??\c:\program files\ReadConvertTo.pub	rundll32.exe
File opened for modification	\??\c:\program files\ReceiveDebug.mp4v	rundll32.exe
File opened for modification	\??\c:\program files\RenameAdd.rmi	rundll32.exe
File opened for modification	\??\c:\program files\UninstallConvertTo.MTS	rundll32.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\wl8ptg587-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\PingMerge.mp3	rundll32.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\wl8ptg587-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\SyncClose.wmv	rundll32.exe
File opened for modification	\??\c:\program files\PushRemove.avi	rundll32.exe
File opened for modification	\??\c:\program files\RepairClear.xlsb	rundll32.exe
File opened for modification	\??\c:\program files\UninstallLock.gif	rundll32.exe
File opened for modification	\??\c:\program files\UpdateSelect.mhtml	rundll32.exe
File opened for modification	\??\c:\program files\BlockRepair.mpe	rundll32.exe
File opened for modification	\??\c:\program files\DenyRename.wvx	rundll32.exe
File opened for modification	\??\c:\program files\LimitDismount.asx	rundll32.exe
File opened for modification	\??\c:\program files\MoveCompress.clr	rundll32.exe
File opened for modification	\??\c:\program files\RedoRevoke.vstm	rundll32.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\wl8ptg587-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\ClearConnect.xml	rundll32.exe
File opened for modification	\??\c:\program files\HideFind.crw	rundll32.exe
File opened for modification	\??\c:\program files\AssertCompare.php	rundll32.exe
File created	\??\c:\program files (x86)\wl8ptg587-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\GrantStep.xml	rundll32.exe
File opened for modification	\??\c:\program files\MoveRename.vsdx	rundll32.exe
File opened for modification	\??\c:\program files\PopBlock.vsdx	rundll32.exe
File created	\??\c:\program files\wl8ptg587-readme.txt	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d578112861900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 430000000100000000000000040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f007400200043004100200058003300000020000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	rundll32.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

rundll32.exe

pid process

2948 rundll32.exe
2948 rundll32.exe
2948 rundll32.exe
2948 rundll32.exe
2948 rundll32.exe

pid	process
2948	rundll32.exe
2948	rundll32.exe
2948	rundll32.exe
2948	rundll32.exe
2948	rundll32.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

rundll32.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	2948	rundll32.exe
Token: SeTakeOwnershipPrivilege	2948	rundll32.exe
Token: SeBackupPrivilege	2460	vssvc.exe
Token: SeRestorePrivilege	2460	vssvc.exe
Token: SeAuditPrivilege	2460	vssvc.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2932 wrote to memory of 2948	2932	rundll32.exe	rundll32.exe
PID 2932 wrote to memory of 2948	2932	rundll32.exe	rundll32.exe
PID 2932 wrote to memory of 2948	2932	rundll32.exe	rundll32.exe
PID 2932 wrote to memory of 2948	2932	rundll32.exe	rundll32.exe
PID 2932 wrote to memory of 2948	2932	rundll32.exe	rundll32.exe
PID 2932 wrote to memory of 2948	2932	rundll32.exe	rundll32.exe
PID 2932 wrote to memory of 2948	2932	rundll32.exe	rundll32.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa0b989579334c305be234de57baa8ffcd7f9e11077820199e58b71bd851c729.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2932

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa0b989579334c305be234de57baa8ffcd7f9e11077820199e58b71bd851c729.dll,#1
2⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2948

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2420

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2460

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Defacement

1

T1491

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\wl8ptg587-readme.txt
Filesize
6KB

MD5
07296e668b92ceae4645f3cc8f52405a

SHA1
088057503b2c69a5916f98199289f81023220a9a

SHA256
f5bf53e194e25700d7dcc7f6bcb10ee1b9bbb2848c02199ca5f9becf1d2d4af9

SHA512
8153ca7fb5c733025f0ae254a7018a2dd08f246e8ac542f9ae087d7cd93081739ee76538bec1f4fb24e47a55b2a532cb9b4dfe670066c8d1f46275414d3f773b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC5F5.tmp
Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\System32\catroot2\dberr.txt
Filesize
192KB

MD5
8461346e362ca17743a432560f77fdf3

SHA1
e925b44c072b7be496a99005c46648f3a6bdcb1a

SHA256
a9b0563a8bd708fef4508ce11e1a6e65519760aa1db8535c2bca94836a7df0b4

SHA512
01ed0d9001c6592974b5da1459bbdca26606256e0c5f2f3825bf7a71a1bc4fb9f20d5a3b4384d5bc27c3c518a4580d7c096156635d4bdfe8dfcb2540b68d7952

Download Submit
memory/2948-9-0x00000000744B0000-0x0000000074597000-memory.dmp

Filesize
924KB

Download
memory/2948-543-0x00000000745A0000-0x0000000074687000-memory.dmp

Filesize
924KB

Download
memory/2948-0-0x00000000744B0000-0x0000000074597000-memory.dmp

Filesize
924KB

Download
memory/2948-7-0x00000000744B1000-0x0000000074528000-memory.dmp

Filesize
476KB

Download
memory/2948-5-0x0000000074490000-0x0000000074577000-memory.dmp

Filesize
924KB

Download
memory/2948-10-0x0000000000740000-0x0000000000761000-memory.dmp

Filesize
132KB

Download
memory/2948-2-0x00000000744B0000-0x0000000074597000-memory.dmp

Filesize
924KB

Download
memory/2948-1-0x00000000744B0000-0x0000000074597000-memory.dmp

Filesize
924KB

Download
memory/2948-544-0x0000000074490000-0x0000000074577000-memory.dmp

Filesize
924KB

Download
memory/2948-558-0x0000000000740000-0x0000000000761000-memory.dmp

Filesize
132KB

Download
memory/2948-573-0x00000000744B1000-0x0000000074528000-memory.dmp

Filesize
476KB

Download
memory/2948-579-0x0000000000740000-0x0000000000761000-memory.dmp

Filesize
132KB

Download
memory/2948-3-0x00000000745A0000-0x0000000074687000-memory.dmp

Filesize
924KB

Download
memory/2948-4-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2948-6-0x00000000744B0000-0x0000000074597000-memory.dmp

Filesize
924KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads