Resubmissions
28/07/2026, 13:20
260728-qlhc2aal3y1012/07/2026, 12:31
260712-pqg3dsby8x312/07/2026, 12:30
260712-ppyczshy6p1025/06/2026, 14:54
260625-r911qac12r1016/06/2026, 13:10
260616-qetgqaet3s1015/06/2026, 16:26
260615-txvdhsfw2q1016/12/2019, 10:54
191216-pg5st7zccj10Analysis
- user interaction
yes - max time kernel
138s - max time network
102s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
15/06/2026, 16:26
General
- Target e5d23a3bb61b99e227bb8cbfc0e7f1e40fea34aac4dcb80acc925cfd7e3d18ec.exe
- Size 535KB
- Sample260615-txvdhsfw2q
- SHA256 e5d23a3bb61b99e227bb8cbfc0e7f1e40fea34aac4dcb80acc925cfd7e3d18ec
Malware Config
Extracted
-
sodinokibi
-
30
-
97
-
gsconcretecoatings.com
-
aciscomputers.com
-
bundan.com
-
customroasts.com
-
triplettagaite.fr
-
physio-lang.de
-
molade.nl
-
comoserescritor.com
-
khtrx.com
-
alexwenzel.de
-
p-ride.live
-
adterium.com
-
eafx.pro
-
sytzedevries.com
-
raeoflightmusic.com
-
xrresources.com
-
livedeveloper.com
-
tastevirginia.com
-
itheroes.dk
-
smartmind.net
-
net
true
-
pid
30
-
prc
sqlagent.exe
sqbcoreservice.exe
visio.exe
wordpad.exe
infopath.exe
xfssvccon.exe
powerpnt.exe
agntsvc.exe
mydesktopservice.exe
mysqld_nt.exe
thunderbird.exe
mspub.exe
thebat.exe
encsvc.exe
excel.exe
dbsnmp.exe
tbirdconfig.exe
steam.exe
mysqld.exe
dbeng50.exe
msftesql.exe
mydesktopqos.exe
sqlservr.exe
msaccess.exe
firefoxconfig.exe
sqlbrowser.exe
thebat64.exe
sqlwriter.exe
winword.exe
mysqld_opt.exe
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
97
Extracted
-
C:\Users\4guo845r53-readme.txt
-
sodinokibi
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 4guo845r53. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7B539A5450CF709E 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/7B539A5450CF709E Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: A3qRutTbGOtpA/jjn3GXHeoDUjcKK9bLMZM0aBc8v+5b4i4wY2+vPIypWcyfoB6G IJ4VNMtYaXxLz98Pwntjomkhh8ixq/Q5NAErO7joeLiNNadEe0lp43ELPXdcuGcg 34A2/YCtRlRlXy0aMmMer6g9Mw+BeDXI/ySG/tT7gQzqYPczaTPaVRoNPzr8NQIJ 02iEPoZsDZkOaHPwkdFpfACthqTzy6ih+imdZFQjsq5iWNkbiXjqCQh5nbE7RZ0x ixgYz2/zIP/eTfMNJjxqIZqM6xZqqcUoUGFuKtLDweLB3FPYPRonnlkQ1K4gs9AB Qf5kE+oEisK/ayNlmI4bSn+6hSzF1na7YL5VajuWDnkLfEn3kYnhZTvLhl2sPEq/ ePWioLPZxps0Xu1ty6QN9aaMYDTuXm32Mf1FB1oqAIxnZ2W51DjyZljWpSqiJ/0f kBprqCw3OhY0FEKqIpT196T1L2AVOm9EJoo2wUfLa7ipFHX9bxX4NapsQeZrId5y TFc5HW357rPs4hjhJuyBpZ9yRGM2ycmRXFGHpMCFLeA8hvG+DDPzPawUBHGQa09U SSlQf9Ti2drw8vrOg+hml+44/PcowUoC3bTV44i8rXw0lWZ90j8CmY+9VHTq24PK sH8r+a2q0wOZPPkWTlEEaVOPtKiKrWgrk13IfvvKP8JW2Z+QOchBKoj1xmZPhXPz QhKik5dEBPmwCWTwHZgxjoA4sZ/Y9q3ESxvAAh0ZaKPOLYxeaQQBkOX7L4Tv+71W nJ7TzUKLdKvbiXKfLG2rlEwH7H6BR1dmIOvVpy0CyH4Nx6lAFnKLqLDneFfORHjy F5rzqMGUOU92FJH0o/odJ0h5qA3dsNmDYv16U1z41Sb8AzYJEtPm1Jh0hPfMkBKx 0Im4zOjkA5x05hq3p5teQwGICaP6TyxjBShYK9Wb7CgdEpP67xmrEDOeOzdq84ta 4qCyeqVnJI+oKKfAiu1O/06NiQHlK/0LGZRlnqmO+wG9CzrdADjJK9j44pwd40Jw RXf42RBOdrY0RWoBdJS1mDrNl6cg1nwjQNamzxrmHKFmmIaDqP78woKSkLnOTpJE yOIWwflW4eMye3O4mqiPAFTvY5Owb7Dfyo7vLHx59oLLI4KK6RFMXxwYbcuj6WGT kSM2RrAqL06dsp3yIP3giDfEdHltGbwdBY0MGcXuteUY3jjN7V7tlbHWr3PhByvL gRReYF2CTJopfsDC2mMhckJdAhv7Lw== Extension name: 4guo845r53 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7B539A5450CF709E
-
http://decryptor.top/7B539A5450CF709E
Signatures
- Family: Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 11 IoCs
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Drops file in Program Files directory 19 IoCs
- Drops file in Windows directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 6 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5d23a3bb61b99e227bb8cbfc0e7f1e40fea34aac4dcb80acc925cfd7e3d18ec.exe"C:\Users\Admin\AppData\Local\Temp\e5d23a3bb61b99e227bb8cbfc0e7f1e40fea34aac4dcb80acc925cfd7e3d18ec.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 50682⤵
- Program crash
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\TestReset.wav"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\CloseOpen.jpg" /ForceBootstrapPaint3D1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc1⤵
- Drops file in System32 directory
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\RepairUnlock.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4048 -ip 40481⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\4guo845r53-readme.txt1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Desktop\WriteMerge.css.4guo845r53"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
4guo845r53-readme.txt
WriteMerge.css.4guo845r53
memory/4048-39-0x00000000041E0000-0x00000000042E0000-memory.dmp
memory/4048-38-0x0000000000400000-0x0000000003F8B000-memory.dmp
memory/4048-469-0x0000000000400000-0x0000000003F8B000-memory.dmp
memory/4048-471-0x0000000000400000-0x0000000003F8B000-memory.dmp
memory/4048-473-0x0000000000400000-0x0000000003F8B000-memory.dmp
memory/4048-16-0x00000000041E0000-0x00000000042E0000-memory.dmp
memory/4328-14-0x00007FF8CD950000-0x00007FF8CEA00000-memory.dmp
memory/4328-13-0x00007FF8CF5A0000-0x00007FF8CF856000-memory.dmp
memory/4328-11-0x00007FF7A05B0000-0x00007FF7A06A8000-memory.dmp
memory/4328-12-0x00007FF8DC710000-0x00007FF8DC744000-memory.dmp
memory/4328-0-0x00007FF8CF84D000-0x00007FF8CF84F000-memory.dmp
memory/4328-4-0x00007FF8CF5A0000-0x00007FF8CF856000-memory.dmp
memory/4328-3-0x00007FF8CF5A0000-0x00007FF8CF856000-memory.dmp
memory/4328-2-0x00007FF8CF5A0000-0x00007FF8CF856000-memory.dmp
memory/4328-1-0x00007FF8CF5A0000-0x00007FF8CF856000-memory.dmp
memory/4884-28-0x000002184B580000-0x000002184B581000-memory.dmp
memory/4884-36-0x000002184B6A0000-0x000002184B6A1000-memory.dmp
memory/4884-35-0x000002184B6A0000-0x000002184B6A1000-memory.dmp
memory/4884-34-0x000002184B690000-0x000002184B691000-memory.dmp
memory/4884-33-0x000002184B690000-0x000002184B691000-memory.dmp
memory/4884-32-0x000002184B600000-0x000002184B601000-memory.dmp
memory/4884-30-0x000002184B600000-0x000002184B601000-memory.dmp
memory/4884-21-0x000002183B2A0000-0x000002183B2B0000-memory.dmp
memory/4884-18-0x000002183B270000-0x000002183B280000-memory.dmp