Analysis
- max time kernel
148s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
29/05/2024, 12:08
Static task
static1
Behavioral task
behavioral1
Sample
aa0b989579334c305be234de57baa8ffcd7f9e11077820199e58b71bd851c729.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
aa0b989579334c305be234de57baa8ffcd7f9e11077820199e58b71bd851c729.dll
Resource
win10v2004-20240426-en
General
- Target aa0b989579334c305be234de57baa8ffcd7f9e11077820199e58b71bd851c729.dll
- Size 1005KB
- Sample240529-payefadg3y
- SHA256 aa0b989579334c305be234de57baa8ffcd7f9e11077820199e58b71bd851c729
- MD5 650dd09b5077b157727868148ddb3307
- SHA1 67c6b2344e9f13eeef5969979a58e999f2f09542
- SHA512 dfcfcd5fc543291a1ea56f6ef82fb98d7c0269bc9be4bfb338aefe08afe700e0b055ac3a82d1426defa53cb1cd63cb46ef9972da776b2c10104293926365b5c8
- SSDEEP 24576:R54YNXJJPMNYGBVsWpZW7Qy8G0DpmAU8wKwTDS:R3JPMNrH40D9hwKWS
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
-
sodinokibi
-
$2a$12$SKsv8RkaiMRiIv.rk505vOoBpUyZQgGeKVc11LA6kWdQcxENhkyjK
-
7595
-
hiddencitysecrets.com.au
-
groupe-frayssinet.fr
-
rimborsobancario.net
-
vietlawconsultancy.com
-
live-your-life.jp
-
verbisonline.com
-
sachnendoc.com
-
htchorst.nl
-
bridgeloanslenders.com
-
petnest.ir
-
myhealth.net.au
-
gopackapp.com
-
jenniferandersonwriter.com
-
logopaedie-blomberg.de
-
osterberg.fi
-
bierensgebakkramen.nl
-
refluxreducer.com
-
thenewrejuveme.com
-
alvinschwartz.wordpress.com
-
leoben.at
-
worldhealthbasicinfo.com
-
bestbet.com
-
mooglee.com
-
extensionmaison.info
-
mediaacademy-iraq.org
-
saxtec.com
-
acomprarseguidores.com
-
iyahayki.nl
-
rozemondcoaching.nl
-
carrybrands.nl
-
camsadviser.com
-
brandl-blumen.de
-
jolly-events.com
-
eglectonk.online
-
bloggyboulga.net
-
manutouchmassage.com
-
caribbeansunpoker.com
-
craftleathermnl.com
-
marathonerpaolo.com
-
stallbyggen.se
-
themadbotter.com
-
remcakram.com
-
kath-kirche-gera.de
-
leda-ukraine.com.ua
-
frontierweldingllc.com
-
fotoideaymedia.es
-
pt-arnold.de
-
bbsmobler.se
-
newyou.at
-
zflas.com
-
mousepad-direkt.de
-
ruralarcoiris.com
-
vloeren-nu.nl
-
faizanullah.com
-
miraclediet.fun
-
analiticapublica.es
-
koko-nora.dk
-
sanaia.com
-
gasolspecialisten.se
-
walkingdeadnj.com
-
neuschelectrical.co.za
-
the-domain-trader.com
-
prochain-voyage.net
-
jiloc.com
-
schoellhammer.com
-
dublikator.com
-
judithjansen.com
-
zweerscreatives.nl
-
bodyforwife.com
-
whittier5k.com
-
nicoleaeschbachorg.wordpress.com
-
finediningweek.pl
-
andersongilmour.co.uk
-
hatech.io
-
catholicmusicfest.com
-
mezhdu-delom.ru
-
compliancesolutionsstrategies.com
-
helenekowalsky.com
-
coding-marking.com
-
whyinterestingly.ru
-
praxis-management-plus.de
-
bodyfulls.com
-
advokathuset.dk
-
punchbaby.com
-
philippedebroca.com
-
cortec-neuro.com
-
burkert-ideenreich.de
-
hannah-fink.de
-
ceres.org.au
-
antenanavi.com
-
no-plans.com
-
gadgetedges.com
-
renergysolution.com
-
uranus.nl
-
forskolorna.org
-
greenpark.ch
-
kaliber.co.jp
-
bsaship.com
-
faronics.com
-
miriamgrimm.de
-
harpershologram.wordpress.com
-
conasmanagement.de
-
yamalevents.com
-
vancouver-print.ca
-
tecnojobsnet.com
-
caffeinternet.it
-
kadesignandbuild.co.uk
-
julis-lsa.de
-
fiscalsort.com
-
maxadams.london
-
nacktfalter.de
-
ungsvenskarna.se
-
schlafsack-test.net
-
eraorastudio.com
-
michaelsmeriglioracing.com
-
foryourhealth.live
-
transliminaltribe.wordpress.com
-
lillegrandpalais.com
-
lionware.de
-
paymybill.guru
-
enovos.de
-
noskierrenteria.com
-
thewellnessmimi.com
-
ctrler.cn
-
flexicloud.hk
-
daniel-akermann-architektur-und-planung.ch
-
solerluethi-allart.ch
-
mylovelybluesky.com
-
hotelzentral.at
-
extraordinaryoutdoors.com
-
ftf.or.at
-
cactusthebrand.com
-
scenepublique.net
-
iwelt.de
-
thomasvicino.com
-
tstaffing.nl
-
bildungsunderlebnis.haus
-
tradiematepro.com.au
-
parkstreetauto.net
-
eadsmurraypugh.com
-
physiofischer.de
-
sandd.nl
-
seagatesthreecharters.com
-
fax-payday-loans.com
-
friendsandbrgrs.com
-
evergreen-fishing.com
-
blgr.be
-
saka.gr
-
mariposapropaneaz.com
-
freie-gewerkschaften.de
-
appsformacpc.com
-
gasbarre.com
-
jvanvlietdichter.nl
-
binder-buerotechnik.at
-
urclan.net
-
dushka.ua
-
hoteledenpadova.it
-
dareckleyministries.com
-
irinaverwer.com
-
vibethink.net
-
pickanose.com
-
mepavex.nl
-
shiftinspiration.com
-
croftprecision.co.uk
-
amylendscrestview.com
-
pmc-services.de
-
servicegsm.net
-
exenberger.at
-
retroearthstudio.com
-
tanciu.com
-
mank.de
-
bxdf.info
-
hellohope.com
-
spargel-kochen.de
-
serce.info.pl
-
jacquin-maquettes.com
-
coastalbridgeadvisors.com
-
live-con-arte.de
-
foretprivee.ca
-
cleliaekiko.online
-
limassoldriving.com
-
cirugiauretra.es
-
datacenters-in-europe.com
-
bafuncs.org
-
blog.solutionsarchitect.guru
-
muamuadolls.com
-
coffreo.biz
-
biortaggivaldelsa.com
-
comparatif-lave-linge.fr
-
centromarysalud.com
-
daklesa.de
-
babcockchurch.org
-
krcove-zily.eu
-
botanicinnovations.com
-
geisterradler.de
-
streamerzradio1.site
-
loprus.pl
-
mymoneyforex.com
-
kingfamily.construction
-
licor43.de
-
courteney-cox.net
-
vetapharma.fr
-
fitnessbazaar.com
-
fairfriends18.de
-
drnice.de
-
d1franchise.com
-
joyeriaorindia.com
-
igfap.com
-
geoffreymeuli.com
-
ulyssemarketing.com
-
boldcitydowntown.com
-
tuuliautio.fi
-
maasreusel.nl
-
jasonbaileystudio.com
-
nataschawessels.com
-
better.town
-
maratonaclubedeportugal.com
-
firstpaymentservices.com
-
ncid.bc.ca
-
ecoledansemulhouse.fr
-
irishmachineryauctions.com
-
mirjamholleman.nl
-
gymnasedumanagement.com
-
apprendrelaudit.com
-
iphoneszervizbudapest.hu
-
rehabilitationcentersinhouston.net
-
hokagestore.com
-
reddysbakery.com
-
hvccfloorcare.com
-
leeuwardenstudentcity.nl
-
globedivers.wordpress.com
-
midmohandyman.com
-
testcoreprohealthuk.com
-
austinlchurch.com
-
baylegacy.com
-
waywithwords.net
-
saarland-thermen-resort.com
-
ausbeverage.com.au
-
izzi360.com
-
upplandsspar.se
-
baumkuchenexpo.jp
-
thedad.com
-
ralister.co.uk
-
operaslovakia.sk
-
desert-trails.com
-
corendonhotels.com
-
lapinlviasennus.fi
-
dontpassthepepper.com
-
pay4essays.net
-
charlottepoudroux-photographie.fr
-
spacecitysisters.org
-
testzandbakmetmening.online
-
calabasasdigest.com
-
herbayupro.com
-
zenderthelender.com
-
socstrp.org
-
coursio.com
-
dsl-ip.de
-
lebellevue.fr
-
delawarecorporatelaw.com
-
heurigen-bauer.at
-
mrxermon.de
-
journeybacktolife.com
-
vitavia.lt
-
35-40konkatsu.net
-
seminoc.com
-
365questions.org
-
sporthamper.com
-
global-kids.info
-
kosterra.com
-
verifort-capital.de
-
onlyresultsmarketing.com
-
apolomarcas.com
-
www1.proresult.no
-
clos-galant.com
-
lapinvihreat.fi
-
ostheimer.at
-
innote.fi
-
psa-sec.de
-
crosspointefellowship.church
-
y-archive.com
-
rollingrockcolumbia.com
-
eco-southafrica.com
-
sarbatkhalsafoundation.org
-
twohourswithlena.wordpress.com
-
karacaoglu.nl
-
kaminscy.com
-
interactcenter.org
-
plastidip.com.ar
-
fotoscondron.com
-
wien-mitte.co.at
-
stoneys.ch
-
koken-voor-baby.nl
-
imperfectstore.com
-
bimnapratica.com
-
fatfreezingmachines.com
-
lecantou-coworking.com
-
otsu-bon.com
-
accountancywijchen.nl
-
behavioralmedicinespecialists.com
-
allfortheloveofyou.com
-
4youbeautysalon.com
-
mastertechengineering.com
-
stingraybeach.com
-
elimchan.com
-
brigitte-erler.com
-
corelifenutrition.com
-
xn--thucmctc-13a1357egba.com
-
mrtour.site
-
creative-waves.co.uk
-
otto-bollmann.de
-
denovofoodsgroup.com
-
slimani.net
-
hashkasolutindo.com
-
kikedeoliveira.com
-
body-guards.it
-
liveottelut.com
-
jusibe.com
-
deltacleta.cat
-
quemargrasa.net
-
travelffeine.com
-
hhcourier.com
-
ki-lowroermond.nl
-
jeanlouissibomana.com
-
hkr-reise.de
-
myteamgenius.com
-
minipara.com
-
tinkoff-mobayl.ru
-
victoriousfestival.co.uk
-
tophumanservicescourses.com
-
kenhnoithatgo.com
-
officehymy.com
-
castillobalduz.es
-
erstatningsadvokaterne.dk
-
puertamatic.es
-
vorotauu.ru
-
oceanastudios.com
-
solhaug.tk
-
qlog.de
-
maryloutaylor.com
-
dutchbrewingcoffee.com
-
promesapuertorico.com
-
love30-chanko.com
-
dubnew.com
-
nsec.se
-
offroadbeasts.com
-
devlaur.com
-
devok.info
-
vannesteconstruct.be
-
corona-handles.com
-
humanityplus.org
-
tandartspraktijkhartjegroningen.nl
-
katketytaanet.fi
-
wychowanieprzedszkolne.pl
-
tarotdeseidel.com
-
kindersitze-vergleich.de
-
dw-css.de
-
financescorecard.com
-
todocaracoles.com
-
atmos-show.com
-
rerekatu.com
-
planchaavapor.net
-
echtveilig.nl
-
siluet-decor.ru
-
bhwlawfirm.com
-
centrospgolega.com
-
withahmed.com
-
danholzmann.com
-
executiveairllc.com
-
hairstylesnow.site
-
commonground-stories.com
-
solinegraphic.com
-
abogadoengijon.es
-
craigvalentineacademy.com
-
zimmerei-deboer.de
-
personalenhancementcenter.com
-
wmiadmin.com
-
smalltownideamill.wordpress.com
-
christ-michael.net
-
lukeshepley.wordpress.com
-
yousay.site
-
trulynolen.co.uk
-
lescomtesdemean.be
-
rocketccw.com
-
smart-light.co.uk
-
edv-live.de
-
profectis.de
-
deprobatehelp.com
-
esope-formation.fr
-
mmgdouai.fr
-
igorbarbosa.com
-
collaborativeclassroom.org
-
ecopro-kanto.com
-
aminaboutique247.com
-
corola.es
-
connectedace.com
-
jyzdesign.com
-
werkkring.nl
-
haar-spange.com
-
uimaan.fi
-
xlarge.at
-
blood-sports.net
-
tonelektro.nl
-
rebeccarisher.com
-
aakritpatel.com
-
roygolden.com
-
ikads.org
-
boulderwelt-muenchen-west.de
-
schmalhorst.de
-
gw2guilds.org
-
galleryartfair.com
-
noixdecocom.fr
-
stemenstilte.nl
-
braffinjurylawfirm.com
-
people-biz.com
-
x-ray.ca
-
iwr.nl
-
cuspdental.com
-
freie-baugutachterpraxis.de
-
crowcanyon.com
-
insidegarage.pl
-
berliner-versicherungsvergleich.de
-
podsosnami.ru
-
selfoutlet.com
-
suncrestcabinets.ca
-
jakekozmor.com
-
carlosja.com
-
sipstroysochi.ru
-
allamatberedare.se
-
despedidascostablanca.es
-
agence-chocolat-noir.com
-
id-et-d.fr
-
strandcampingdoonbeg.com
-
zieglerbrothers.de
-
smessier.com
-
kevinjodea.com
-
makeitcount.at
-
8449nohate.org
-
homesdollar.com
-
ino-professional.ru
-
abogadosadomicilio.es
-
101gowrie.com
-
euro-trend.pl
-
id-vet.com
-
aniblinova.wordpress.com
-
div-vertriebsforschung.de
-
bauertree.com
-
123vrachi.ru
-
argenblogs.com.ar
-
marketingsulweb.com
-
completeweddingkansas.com
-
boisehosting.net
-
ccpbroadband.com
-
verytycs.com
-
modestmanagement.com
-
iqbalscientific.com
-
mrsplans.net
-
d2marketing.co.uk
-
tips.technology
-
danubecloud.com
-
airconditioning-waalwijk.nl
-
xn--logopdie-leverkusen-kwb.de
-
basisschooldezonnewijzer.nl
-
homecomingstudio.com
-
liikelataamo.fi
-
higadograsoweb.com
-
boompinoy.com
-
digivod.de
-
kafu.ch
-
lusak.at
-
modelmaking.nl
-
kostenlose-webcams.com
-
new.devon.gov.uk
-
importardechina.info
-
ausair.com.au
-
hotelsolbh.com.br
-
walter-lemm.de
-
beaconhealthsystem.org
-
1team.es
-
unetica.fr
-
allentownpapershow.com
-
nakupunafoundation.org
-
parkcf.nl
-
elpa.se
-
triggi.de
-
thee.network
-
ianaswanson.com
-
macabaneaupaysflechois.com
-
homng.net
-
lynsayshepherd.co.uk
-
xn--fnsterputssollentuna-39b.se
-
mediaplayertest.net
-
perbudget.com
-
rhinosfootballacademy.com
-
abogadosaccidentetraficosevilla.es
-
team-montage.dk
-
sterlingessay.com
-
joseconstela.com
-
bigbaguettes.eu
-
caribdoctor.org
-
katiekerr.co.uk
-
edrcreditservices.nl
-
slwgs.org
-
ledmes.ru
-
gratispresent.se
-
pmcimpact.com
-
xn--singlebrsen-vergleich-nec.com
-
pv-design.de
-
healthyyworkout.com
-
stormwall.se
-
bristolaeroclub.co.uk
-
filmstreamingvfcomplet.be
-
latribuessentielle.com
-
fizzl.ru
-
theshungiteexperience.com.au
-
siliconbeach-realestate.com
-
hexcreatives.co
-
liliesandbeauties.org
-
markelbroch.com
-
revezlimage.com
-
bayoga.co.uk
-
sahalstore.com
-
amerikansktgodis.se
-
jsfg.com
-
deepsouthclothingcompany.com
-
asteriag.com
-
crowd-patch.co.uk
-
dekkinngay.com
-
consultaractadenacimiento.com
-
theclubms.com
-
milanonotai.it
-
maineemploymentlawyerblog.com
-
hrabritelefon.hr
-
lichencafe.com
-
mardenherefordshire-pc.gov.uk
-
pointos.com
-
autofolierung-lu.de
-
qualitaetstag.de
-
ymca-cw.org.uk
-
stupbratt.no
-
celeclub.org
-
mylolis.com
-
antiaginghealthbenefits.com
-
webcodingstudio.com
-
femxarxa.cat
-
edgewoodestates.org
-
theadventureedge.com
-
syndikat-asphaltfieber.de
-
lascuola.nl
-
smithmediastrategies.com
-
groupe-cets.com
-
dirittosanitario.biz
-
dutchcoder.nl
-
tongdaifpthaiphong.net
-
ussmontanacommittee.us
-
ventti.com.ar
-
destinationclients.fr
-
simpkinsedwards.co.uk
-
richard-felix.co.uk
-
delchacay.com.ar
-
bricotienda.com
-
nijaplay.com
-
stoeferlehalle.de
-
systemate.dk
-
deko4you.at
-
architekturbuero-wagner.net
-
bockamp.com
-
cheminpsy.fr
-
associacioesportivapolitg.cat
-
bouldercafe-wuppertal.de
-
alysonhoward.com
-
intecwi.com
-
grelot-home.com
-
readberserk.com
-
pasivect.co.uk
-
slashdb.com
-
klimt2012.info
-
vox-surveys.com
-
labobit.it
-
bargningavesta.se
-
tennisclubetten.nl
-
hmsdanmark.dk
-
aurum-juweliere.de
-
lightair.com
-
proudground.org
-
chaotrang.com
-
naturavetal.hr
-
autodemontagenijmegen.nl
-
vyhino-zhulebino-24.ru
-
paulisdogshop.de
-
ihr-news.jp
-
adultgamezone.com
-
spsshomeworkhelp.com
-
levdittliv.se
-
vihannesporssi.fi
-
shhealthlaw.com
-
tsklogistik.eu
-
bradynursery.com
-
cwsitservices.co.uk
-
augenta.com
-
huissier-creteil.com
-
gmto.fr
-
cimanchesterescorts.co.uk
-
pubweb.carnet.hr
-
linnankellari.fi
-
huehnerauge-entfernen.de
-
bee4win.com
-
anybookreader.de
-
promalaga.es
-
bouncingbonanza.com
-
thailandholic.com
-
harveybp.com
-
fayrecreations.com
-
surespark.org.uk
-
zimmerei-fl.de
-
marchand-sloboda.com
-
odiclinic.org
-
rafaut.com
-
nestor-swiss.ch
-
synlab.lt
-
poultrypartners.nl
-
argos.wityu.fund
-
artige.com
-
dezatec.es
-
backstreetpub.com
-
patrickfoundation.net
-
meusharklinithome.wordpress.com
-
shiresresidential.com
-
tinyagency.com
-
mooreslawngarden.com
-
blossombeyond50.com
-
restaurantesszimmer.de
-
ilso.net
-
trapiantofue.it
-
bordercollie-nim.nl
-
idemblogs.com
-
malychanieruchomoscipremium.com
-
galserwis.pl
-
tanzprojekt.com
-
lucidinvestbank.com
-
tampaallen.com
-
gporf.fr
-
waveneyrivercentre.co.uk
-
onlybacklink.com
-
ouryoungminds.wordpress.com
-
torgbodenbollnas.se
-
bastutunnan.se
-
vesinhnha.com.vn
-
mapawood.com
-
microcirc.net
-
bundabergeyeclinic.com.au
-
dramagickcom.wordpress.com
-
woodleyacademy.org
-
herbstfeststaefa.ch
-
makeflowers.ru
-
deschl.net
-
lachofikschiet.nl
-
oncarrot.com
-
videomarketing.pro
-
winrace.no
-
polychromelabs.com
-
kampotpepper.gives
-
coding-machine.com
-
thefixhut.com
-
abitur-undwieweiter.de
-
kao.at
-
chefdays.de
-
stopilhan.com
-
1kbk.com.ua
-
paradicepacks.com
-
madinblack.com
-
monark.com
-
quickyfunds.com
-
ladelirante.fr
-
klusbeter.nl
-
jobmap.at
-
montrium.com
-
sojamindbody.com
-
ogdenvision.com
-
cafemattmeera.com
-
manijaipur.com
-
mindpackstudios.com
-
dpo-as-a-service.com
-
seitzdruck.com
-
yourobgyn.net
-
darnallwellbeing.org.uk
-
vickiegrayimages.com
-
mbfagency.com
-
thaysa.com
-
csgospeltips.se
-
comarenterprises.com
-
triactis.com
-
arteservicefabbro.com
-
cursoporcelanatoliquido.online
-
blewback.com
-
fitovitaforum.com
-
merzi.info
-
pinkexcel.com
-
eaglemeetstiger.de
-
cranleighscoutgroup.org
-
mirkoreisser.de
-
vdberg-autoimport.nl
-
danskretursystem.dk
-
sw1m.ru
-
figura.team
-
launchhubl.com
-
nuzech.com
-
digi-talents.com
-
jerling.de
-
work2live.de
-
rota-installations.co.uk
-
actecfoundation.org
-
carriagehousesalonvt.com
-
mountaintoptinyhomes.com
-
platformier.com
-
imaginado.de
-
candyhouseusa.com
-
dlc.berlin
-
blogdecachorros.com
-
peterstrobos.com
-
aselbermachen.com
-
cerebralforce.net
-
ligiercenter-sachsen.de
-
ditog.fr
-
waynela.com
-
ilive.lt
-
embracinghiscall.com
-
hugoversichert.de
-
manifestinglab.com
-
drugdevice.org
-
ra-staudte.de
-
takeflat.com
-
bookspeopleplaces.com
-
wasmachtmeinfonds.at
-
wacochamber.com
-
chandlerpd.com
-
crediacces.com
-
fitnessingbyjessica.com
-
stefanpasch.me
-
stampagrafica.es
-
xn--rumung-bua.online
-
facettenreich27.de
-
atozdistribution.co.uk
-
quizzingbee.com
-
vanswigchemdesign.com
-
jadwalbolanet.info
-
micro-automation.de
-
romeguidedvisit.com
-
evologic-technologies.com
-
spinheal.ru
-
insigniapmg.com
-
spylista.com
-
autodujos.lt
-
ateliergamila.com
-
almosthomedogrescue.dog
-
oldschoolfun.net
-
alhashem.net
-
theletter.company
-
pivoineetc.fr
-
xn--fn-kka.no
-
qualitus.com
-
polzine.net
-
ivfminiua.com
-
xltyu.com
-
webhostingsrbija.rs
-
simulatebrain.com
-
sofavietxinh.com
-
rushhourappliances.com
-
sla-paris.com
-
answerstest.ru
-
makeurvoiceheard.com
-
chavesdoareeiro.com
-
stoeberstuuv.de
-
tanzschule-kieber.de
-
notmissingout.com
-
igrealestate.com
-
nancy-informatique.fr
-
rumahminangberdaya.com
-
garage-lecompte-rouen.fr
-
mir-na-iznanku.com
-
birnam-wood.com
-
colorofhorses.com
-
lloydconstruction.com
-
cnoia.org
-
roadwarrior.app
-
urmasiimariiuniri.ro
-
itelagen.com
-
balticdentists.com
-
cursosgratuitosnainternet.com
-
modamilyon.com
-
pelorus.group
-
jobcenterkenya.com
-
parebrise-tla.fr
-
heidelbergartstudio.gallery
-
ivivo.es
-
lapmangfpt.info.vn
-
berlin-bamboo-bikes.org
-
artotelamsterdam.com
-
greenko.pl
-
danielblum.info
-
projetlyonturin.fr
-
tastewilliamsburg.com
-
securityfmm.com
-
toreria.es
-
sauschneider.info
-
wsoil.com.sg
-
centuryrs.com
-
purposeadvisorsolutions.com
-
tenacitytenfold.com
-
architecturalfiberglass.org
-
plotlinecreative.com
-
citymax-cr.com
-
vitalyscenter.es
-
myhostcloud.com
-
easytrans.com.au
-
simoneblum.de
-
drinkseed.com
-
greenfieldoptimaldentalcare.com
-
heliomotion.com
-
pixelarttees.com
-
bogdanpeptine.ro
-
beyondmarcomdotcom.wordpress.com
-
chatizel-paysage.fr
-
the-virtualizer.com
-
kunze-immobilien.de
-
creamery201.com
-
advizewealth.com
-
brevitempore.net
-
expandet.dk
-
blacksirius.de
-
humancondition.com
-
pcp-nc.com
-
art2gointerieurprojecten.nl
-
grupocarvalhoerodrigues.com.br
-
toponlinecasinosuk.co.uk
-
c-a.co.in
-
filmvideoweb.com
-
teresianmedia.org
-
gemeentehetkompas.nl
-
smartypractice.com
-
fannmedias.com
-
wurmpower.at
-
summitmarketingstrategies.com
-
4net.guru
-
ilcdover.com
-
dubscollective.com
-
xoabigail.com
-
pcprofessor.com
-
321play.com.hk
-
iviaggisonciliegie.it
-
maureenbreezedancetheater.org
-
shsthepapercut.com
-
nvwoodwerks.com
-
bowengroup.com.au
-
bigler-hrconsulting.ch
-
web.ion.ag
-
assurancesalextrespaille.fr
-
unim.su
-
upmrkt.co
-
bptdmaluku.com
-
antonmack.de
-
icpcnj.org
-
buroludo.nl
-
sabel-bf.com
-
schraven.de
-
parks-nuernberg.de
-
jorgobe.at
-
brawnmediany.com
-
rieed.de
-
handi-jack-llc.com
-
asgestion.com
-
campus2day.de
-
controldekk.com
-
rksbusiness.com
-
longislandelderlaw.com
-
associationanalytics.com
-
n1-headache.com
-
teczowadolina.bytom.pl
-
jbbjw.com
-
huesges-gruppe.de
-
happyeasterimages.org
-
vibehouse.rw
-
alten-mebel63.ru
-
wari.com.pe
-
funjose.org.gt
-
smokeysstoves.com
-
dinslips.se
-
12starhd.online
-
moveonnews.com
-
penco.ie
-
c2e-poitiers.com
-
mercantedifiori.com
-
christinarebuffetcourses.com
-
musictreehouse.net
-
teknoz.net
-
portoesdofarrobo.com
-
sagadc.com
-
leather-factory.co.jp
-
denifl-consulting.at
-
hushavefritid.dk
-
kidbucketlist.com.au
-
lubetkinmediacompanies.com
-
notsilentmd.org
-
sevenadvertising.com
-
hardinggroup.com
-
kojima-shihou.com
-
kalkulator-oszczednosci.pl
-
aco-media.nl
-
phantastyk.com
-
nachhilfe-unterricht.com
-
zzyjtsgls.com
-
praxis-foerderdiagnostik.de
-
westdeptfordbuyrite.com
-
em-gmbh.ch
-
balticdermatology.lt
-
villa-marrakesch.de
-
veybachcenter.de
-
latestmodsapks.com
-
falcou.fr
-
pawsuppetlovers.com
-
allure-cosmetics.at
-
havecamerawilltravel2017.wordpress.com
-
entopic.com
-
abl1.net
-
ai-spt.jp
-
highlinesouthasc.com
-
employeesurveys.com
-
naswrrg.org
-
jameskibbie.com
-
mdk-mediadesign.de
-
oneplusresource.org
-
effortlesspromo.com
-
hihaho.com
-
aarvorg.com
-
urist-bogatyr.ru
-
conexa4papers.trade
-
truenyc.co
-
pogypneu.sk
-
troegs.com
-
ncs-graphic-studio.com
-
buymedical.biz
-
blumenhof-wegleitner.at
-
imadarchid.com
-
glennroberts.co.nz
-
henricekupper.com
-
body-armour.online
-
dnepr-beskid.com.ua
-
dr-seleznev.com
-
ftlc.es
-
evangelische-pfarrgemeinde-tuniberg.de
-
ziegler-praezisionsteile.de
-
baptisttabernacle.com
-
girlillamarketing.com
-
luxurytv.jp
-
agence-referencement-naturel-geneve.net
-
mytechnoway.com
-
ora-it.de
-
smale-opticiens.nl
-
mbxvii.com
-
bunburyfreightservices.com.au
-
2ekeus.nl
-
darrenkeslerministries.com
-
biapi-coaching.fr
-
yassir.pro
-
lange.host
-
kamienny-dywan24.pl
-
adoptioperheet.fi
-
nosuchthingasgovernment.com
-
you-bysia.com.au
-
kojinsaisei.info
-
alfa-stroy72.com
-
justinvieira.com
-
lorenacarnero.com
-
raschlosser.de
-
partnertaxi.sk
-
anthonystreetrimming.com
-
plantag.de
-
bigasgrup.com
-
pier40forall.org
-
trackyourconstruction.com
-
kamahouse.net
-
broseller.com
-
shonacox.com
-
songunceliptv.com
-
kisplanning.com.au
-
myzk.site
-
campusoutreach.org
-
anteniti.com
-
hypozentrum.com
-
mooshine.com
-
cyntox.com
-
run4study.com
-
narcert.com
-
southeasternacademyofprosthodontics.org
-
softsproductkey.com
-
dr-tremel-rednitzhembach.de
-
sobreholanda.com
-
devstyle.org
-
insp.bi
-
hebkft.hu
-
norpol-yachting.com
-
juneauopioidworkgroup.org
-
finde-deine-marke.de
-
hairnetty.wordpress.com
-
nativeformulas.com
-
norovirus-ratgeber.de
-
thedresserie.com
-
oneheartwarriors.at
-
wolf-glas-und-kunst.de
-
milltimber.aberdeen.sch.uk
-
skiltogprint.no
-
socialonemedia.com
-
micahkoleoso.de
-
resortmtn.com
-
psnacademy.in
-
aprepol.com
-
littlebird.salon
-
nmiec.com
-
aodaichandung.com
-
drfoyle.com
-
nurturingwisdom.com
-
rostoncastings.co.uk
-
atalent.fi
-
beautychance.se
-
schutting-info.nl
-
wraithco.com
-
houseofplus.com
-
carolinepenn.com
-
theduke.de
-
pridoxmaterieel.nl
-
morawe-krueger.de
-
zewatchers.com
-
milestoneshows.com
-
sportverein-tambach.de
-
visiativ-industry.fr
-
lykkeliv.net
-
sloverse.com
-
theapifactory.com
-
olejack.ru
-
lbcframingelectrical.com
-
besttechie.com
-
trystana.com
-
fundaciongregal.org
-
seevilla-dr-sturm.at
-
international-sound-awards.com
-
ontrailsandboulevards.com
-
rosavalamedahr.com
-
lefumetdesdombes.com
-
memaag.com
-
autopfand24.de
-
dr-pipi.de
-
oslomf.no
-
deoudedorpskernnoordwijk.nl
-
xtptrack.com
-
tomoiyuma.com
-
marietteaernoudts.nl
-
polymedia.dk
-
wellplast.se
-
sairaku.net
-
sportiomsportfondsen.nl
-
craigmccabe.fun
-
nhadatcanho247.com
-
luckypatcher-apkz.com
-
classycurtainsltd.co.uk
-
ceid.info.tr
-
mountsoul.de
-
seproc.hn
-
cityorchardhtx.com
-
forestlakeuca.org.au
-
radaradvies.nl
-
tetinfo.in
-
turkcaparbariatrics.com
-
talentwunder.com
-
presseclub-magdeburg.de
-
precisionbevel.com
-
cuppacap.com
-
fensterbau-ziegler.de
-
fransespiegels.nl
-
simpliza.com
-
satyayoga.de
-
kuntokeskusrok.fi
-
epwritescom.wordpress.com
-
naturstein-hotte.de
-
nandistribution.nl
-
zso-mannheim.de
-
tux-espacios.com
-
noesis.tech
-
pomodori-pizzeria.de
-
kirkepartner.dk
-
naturalrapids.com
-
fibrofolliculoma.info
-
pierrehale.com
-
pasvenska.se
-
samnewbyjax.com
-
marcuswhitten.site
-
plv.media
-
transportesycementoshidalgo.es
-
johnsonfamilyfarmblog.wordpress.com
-
commercialboatbuilding.com
-
directwindowco.com
-
ncuccr.org
-
lmtprovisions.com
-
charlesreger.com
-
bingonearme.org
-
tomaso.gr
-
outcomeisincome.com
-
starsarecircular.org
-
vermoote.de
-
gantungankunciakrilikbandung.com
-
admos-gleitlager.de
-
americafirstcommittee.org
-
edelman.jp
-
faroairporttransfers.net
-
DupontSellsHomes.com
-
baronloan.org
-
tandartspraktijkheesch.nl
-
waermetauscher-berechnen.de
-
kaotikkustomz.com
-
aglend.com.au
-
parking.netgateway.eu
-
smogathon.com
-
smejump.co.th
-
goodgirlrecovery.com
-
sotsioloogia.ee
-
tulsawaterheaterinstallation.com
-
symphonyenvironmental.com
-
shadebarandgrillorlando.com
-
highimpactoutdoors.net
-
thomas-hospital.de
-
opatrovanie-ako.sk
-
artallnightdc.com
-
all-turtles.com
-
skanah.com
-
supportsumba.nl
-
knowledgemuseumbd.com
-
helikoptervluchtnewyork.nl
-
lenreactiv-shop.ru
-
calxplus.eu
-
abuelos.com
-
senson.fi
-
mikeramirezcpa.com
-
i-arslan.de
-
iyengaryogacharlotte.com
-
kissit.ca
-
copystar.co.uk
-
gamesboard.info
-
boosthybrid.com.au
-
first-2-aid-u.com
-
ravensnesthomegoods.com
-
asiluxury.com
-
gonzalezfornes.es
-
smhydro.com.pl
-
sportsmassoren.com
-
kmbshipping.co.uk
-
webmaster-peloton.com
-
schoolofpassivewealth.com
-
sexandfessenjoon.wordpress.com
-
tigsltd.com
-
educar.org
-
gastsicht.de
-
familypark40.com
-
ohidesign.com
-
kariokids.com
-
simplyblessedbykeepingitreal.com
-
ecpmedia.vn
-
bargningharnosand.se
-
nokesvilledentistry.com
-
aunexis.ch
-
spd-ehningen.de
-
baustb.de
-
diversiapsicologia.es
-
sinal.org
-
porno-gringo.com
-
zonamovie21.net
-
strategicstatements.com
-
xn--vrftet-pua.biz
-
pocket-opera.de
-
cite4me.org
-
gaiam.nl
-
spectrmash.ru
-
farhaani.com
-
stacyloeb.com
-
zervicethai.co.th
-
pferdebiester.de
-
alsace-first.com
-
haremnick.com
-
stemplusacademy.com
-
instatron.net
-
psc.de
-
slupetzky.at
-
milsing.hr
-
navyfederalautooverseas.com
-
jandaonline.com
-
piajeppesen.dk
-
woodworkersolution.com
-
durganews.com
-
mrsfieldskc.com
-
ampisolabergeggi.it
-
mediaclan.info
-
kedak.de
-
geekwork.pl
-
bouquet-de-roses.com
-
panelsandwichmadrid.es
-
i-trust.dk
-
abogados-en-alicante.es
-
real-estate-experts.com
-
levihotelspa.fi
-
steampluscarpetandfloors.com
-
sanyue119.com
-
space.ua
-
slimidealherbal.com
-
ahouseforlease.com
-
chrissieperry.com
-
celularity.com
-
degroenetunnel.com
-
mdacares.com
-
oemands.dk
-
krlosdavid.com
-
newstap.com.ng
-
sweering.fr
-
layrshift.eu
-
net
true
-
pid
$2a$12$SKsv8RkaiMRiIv.rk505vOoBpUyZQgGeKVc11LA6kWdQcxENhkyjK
-
prc
firefox
mydesktopservice
xfssvccon
infopath
visio
encsvc
onenote
ocssd
ocautoupds
excel
agntsvc
outlook
mspub
iconcerto
wordpad
sqbcoreservice
winword
oracle
thunderbird
ocomm
mydesktopqos
steam
dbsnmp
sql
synctime
tbirdconfig
dbeng50
isqlplussvc
msaccess
thebat
powerpnt
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
7595
-
svc
memtas
veeam
sophos
sql
vss
svc$
mepocs
backup
Extracted
-
C:\Recovery\647nkcs9-readme.txt
-
sodinokibi
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 647nkcs9. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/865861541418CF3A 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/865861541418CF3A Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: SJSAfwbmX+qZ2anIHz/Nrlq9KxLbgf5AOpY+Up380HwtAOADSCt7rbWpYHRWDR8I UVOvMP9du5eoZfKTJ8QnDHr7DzdTM6iXLZ6jrJcvovQoLWzcrOvawogSUV6et8OI wDD/kvAUCoZWtKtSR5O5jIYRtMyAPzHIgpw/NxDIa95JF0BL1WjEC15BYDiAwM7e kMaQ7gfYbONpA/TYOdJzC+qnNQM8+fOkGEeq3sr2pDQVBXNAUK1Oz0GqlRgZ4ns4 xx4FG/bBgfZfyvkdXEOrOv4e9hnKipeYv8jjjcHyd7Zy48pKmZy3Nj6SIa3kJYDi mVj+eLrw7LO5qe84xolK79CB5vkoGq/SCRELhzqoUIMCtlkJ4nMJ2mNk7ws1qahk 2MgEJpjGj8m0MtLGDRiBqidXwnQ2Ht3imxT3CRc+eM9sb/34M7eDYVazVIqbMy6N wtWarcVsRrdjeLAuDSdRDqVgmT+g1ThQ4daDUl+ufYiIiRHyaQaH0ooJdOVavi8g WGpvzkIkXAZKMCuqMg0Ky85IkkuRFTqQ8DqIXR4lwOJNeyHp/IzFVxiXlg1j1mVB yz6JtWqfU8L5aKQsHQrpXE4fpytj3Bn0IilSxD5KfWHOgfpVZOIn5D5MnuBW9F3y 0mQtXk8HjsZDGsd+uu0TDWIM9reCfmtaENQAILuJHrN5d3iHNhlnEtaCbcjr4lpo SrVeqsZ3+/eoypOkGt9/4wUySx8YxL/65psdR9Rw8uCjlC1vtScCP/HWWnyV/zkw 9myJHuxMznCOX9OYLimdmmSJ78U2uAXLg0qG4EBFwL5ryh9M5WX9fZ+b9XIcSv7E axR8ouxdGosvtUkqtzYb92bZxtMjLSRl9/RQRTfdq+8Ch8Y1AEVjsvrnUtaSissT y18OUCkvfAF3Pf+W58mS24oNss/A0HIIzvNnKy5QXpU1d3I2LDakRauUAnJJpYXT 6bvsztQlX0M99iV+BEGtAfYa5/gRm3NEBVtvGxg+YxD8re85HXfAr2VeGkZQ7Qrg 9YdKVHq9SNWlogKUnxszqWWeNczdIMYC9AFbUbPFnoCBxbwHJH04ZWl7kK463cD6 6qfjV4qFxW0lYNmyqUiD53ky9nugYCgfifKaUe6O7wlrLVav5Hi1nAOtKNWu/EKI RUybY9yvrhPduJ4FlBRFl6jqB5cy9JJ8GR64j66kgNJMUACaj1eFGiOGx3MrX6ES tM+Sb99HV8HH1oC2iuH+rckZRd/W+jPirctgQG0tfqtK0t7hWObxsHyTv5zbyS7/ uboMezd4wIqj/8QHW+rgGyM14ZWbLnA2WdcqZnRIH/GpZOL7G9NuAjM6boWjgei3 trW0b38D8pnOc2QPllTB82bZyoxVTny3g1aJ09OzC0k= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/865861541418CF3A
-
http://decoder.re/865861541418CF3A
Signatures
- Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
- Blocklisted process makes network request 17 IoCs
flow pid Process 38 1840 rundll32.exe 44 1840 rundll32.exe 46 1840 rundll32.exe 51 1840 rundll32.exe 54 1840 rundll32.exe 58 1840 rundll32.exe 60 1840 rundll32.exe 62 1840 rundll32.exe 66 1840 rundll32.exe 68 1840 rundll32.exe 71 1840 rundll32.exe 75 1840 rundll32.exe 79 1840 rundll32.exe 82 1840 rundll32.exe 84 1840 rundll32.exe 86 1840 rundll32.exe 90 1840 rundll32.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\U: rundll32.exe File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\P: rundll32.exe File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\A: rundll32.exe File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\T: rundll32.exe File opened (read-only) \??\Z: rundll32.exe File opened (read-only) \??\B: rundll32.exe File opened (read-only) \??\E: rundll32.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\F: rundll32.exe File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\V: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\D: rundll32.exe File opened (read-only) \??\J: rundll32.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fu8g.bmp" rundll32.exe - Drops file in Program Files directory 28 IoCs
description ioc Process File opened for modification \??\c:\program files\TraceExport.asf rundll32.exe File opened for modification \??\c:\program files\StepGrant.jfif rundll32.exe File created \??\c:\program files (x86)\647nkcs9-readme.txt rundll32.exe File opened for modification \??\c:\program files\BlockExit.vstm rundll32.exe File opened for modification \??\c:\program files\MovePop.emf rundll32.exe File opened for modification \??\c:\program files\ConfirmLock.js rundll32.exe File opened for modification \??\c:\program files\DenyMeasure.mpeg rundll32.exe File opened for modification \??\c:\program files\ExpandBackup.rm rundll32.exe File opened for modification \??\c:\program files\ExitTrace.midi rundll32.exe File opened for modification \??\c:\program files\SkipRename.pptm rundll32.exe File opened for modification \??\c:\program files\ShowApprove.3g2 rundll32.exe File opened for modification \??\c:\program files\UninstallReceive.wpl rundll32.exe File opened for modification \??\c:\program files\ImportInitialize.odt rundll32.exe File opened for modification \??\c:\program files\ImportWrite.tif rundll32.exe File opened for modification \??\c:\program files\InitializeCompare.aiff rundll32.exe File opened for modification \??\c:\program files\RepairConvertTo.nfo rundll32.exe File opened for modification \??\c:\program files\RestoreEnable.ppt rundll32.exe File opened for modification \??\c:\program files\CloseSubmit.dwg rundll32.exe File opened for modification \??\c:\program files\CompareUnpublish.MTS rundll32.exe File opened for modification \??\c:\program files\ImportConvertFrom.hta rundll32.exe File opened for modification \??\c:\program files\SuspendWait.AAC rundll32.exe File created \??\c:\program files\647nkcs9-readme.txt rundll32.exe File opened for modification \??\c:\program files\FindImport.rtf rundll32.exe File opened for modification \??\c:\program files\OpenSwitch.wps rundll32.exe File opened for modification \??\c:\program files\UseSync.dotx rundll32.exe File opened for modification \??\c:\program files\CompleteUninstall.vsdm rundll32.exe File opened for modification \??\c:\program files\CopyDeny.odt rundll32.exe File opened for modification \??\c:\program files\DisconnectImport.csv rundll32.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe 1840 rundll32.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1840 rundll32.exe Token: SeTakeOwnershipPrivilege 1840 rundll32.exe Token: SeBackupPrivilege 2820 vssvc.exe Token: SeRestorePrivilege 2820 vssvc.exe Token: SeAuditPrivilege 2820 vssvc.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 640 wrote to memory of 1840 640 rundll32.exe 82 PID 640 wrote to memory of 1840 640 rundll32.exe 82 PID 640 wrote to memory of 1840 640 rundll32.exe 82 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\aa0b989579334c305be234de57baa8ffcd7f9e11077820199e58b71bd851c729.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\aa0b989579334c305be234de57baa8ffcd7f9e11077820199e58b71bd851c729.dll,#12⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1840
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:4708
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2820
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Recovery\647nkcs9-readme.txt
- Size 6KB
- SHA256 82d5902f4b0505aad913817122c5cbaf4e0036bd963afbf69ed270f9851f8e2b
- MD5 e9db9249b6126df1004ed6bfc20984b5
- SHA1 39c7fce464491fa42bf7635dae429e6e6c0cfe25
- SHA512 c337c466deec97976cbcb51d86994182e3b1ab95dd17f8c73d011aa13ee8c03413b9d55d2b624ece6cd18f4fda54adc17acb6d625d3a90d21bf150d7664cc842
- SSDEEP 96:GL8XiNsgROwxU3TPP6wAYemEL6GZtiOvug2aiFAenBfnIoKaAd9PrR5u:GL8Xj3jP9gmEL6GpvxiZZtxwDW
- MD5 SHA1 SHA512 SSDEEP