Overview

overview

10

Static

static

10

v2.exe

windows10-2004-x64

10

v2.exe

windows11-ltsc_2024-x64

10

Resubmissions

23/09/2026, 16:58

260923-vg6bhsfg5310

06/09/2026, 16:14

260906-tp1kkawtev10

05/09/2026, 18:17

260905-ww6fhagk9y10

05/09/2026, 18:17

260905-ww55qsgk9w

14/08/2026, 18:05

260814-wn795abb2310

25/05/2026, 01:59

260525-ceefxaat4n10

01/05/2026, 12:22

260501-pj17pabt5j10

21/04/2026, 16:21

260421-ttqadsht2l10

21/04/2026, 16:07

260421-tk2xtscx7110

19/04/2026, 20:34

260419-zcnccsey4s10

Analysis

  • user interaction
    yes
  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/09/2026, 16:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    v2.exe
  • Size 121KB
  • Sample260923-vg6bhsfg53
  • SHA256 74ce1be7fe32869dbbfe599d7992c306a7ee693eb517924135975daa64a3a92f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdiscoverysodinokibipersistenceprivilege_escalationransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Recovery\17wei5u4-readme.txt

  • sodinokibi

Ransom Note
  • ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 17wei5u4. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F08BC80F5965BF97 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/F08BC80F5965BF97 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 4DgDgl6DL6hVniYCYkLh3bo3TLGxwpBbRUE5srdM796I6xyxNFoL72er6rc2QZJU Htr2BWI4U0lg22iFVyaqHn5098ABZaVioDuxZHH2OX5pB8bY+6KEKEXMdLIImcIq Qf/IyCZ7/UFaSu6vZflrrjKDndmpY0bxSkAqYhM4KdWyGZ650IU3AKKnwBifi+99 fQIbiGDybZe/cftvvEPZuDBk3ATPVrIhP/w+6uc9u77j9TA523bB+YW41m/D5Edv B289f4l3nzauwrBtIFsKXvCZnV/rsgS1YSNWf7oe1/1o+3VbjPXWuTsFg6r3lIQZ XNM2AXSmg0ikQjgeoR4sgdxc5NgH6xyZWUVi2uToJMHJwA/UTLKYJownubYJe4E8 PiA6GGDajxjLEkwrT2pkqKUbXDyzQm4h6e1DWubNk/qKm+DT1CEMerhJDsbipGAQ 2ot+AazNkCfTGJP+M8SrcruKp1A7H6Agint/rEDT4C5xYzXhNBCR8BZM5rxEhM0d KW2rH4fR08h0EO79c6kso8hlaDThC0dXpZ7qzBIkQFC0FHxZJC/0i+1dUFVwbGIY Oq9sD8XmYvxDLPwM+EzpLoLxGupQ1FGSsPP4zxiELGQJc/17yBAING6qCnplL0AJ 5pkTH96Vl0G8Q6G6rQkNdVpNXTBPWWyNwMRQagb9wqh4v2kmxVmNpJa1dpSRZUPw 6i3VS5ZuEp4uwfvZ8dPadCBkY9tbzTA0cLmzxUuxr84NxkOexxBLXs/5/ei+qxx2 pGyhDjqHkOmyNjweVmuXr8d+em6JD/MrscCeTgz7f67Leice3Vzw5riWVZDu9RmJ ZHjIz561TKrGnoEkAGL+tO2bdnpJYvv6eNdQ7pFRiv7pWQd+ghcYdhs50xaJImSX BIVwG6ZSeJyO1Z/3hSZqJrJAFLXOHMDA3FmUAnRdlhujMwImEdUQ6vl/90q+NDSq jDtsU9zHjlua+0iS6XMZ2+dcg8X5CCKAu/uC9C3FQYq5nOLyfPAb7780wT+BEWvz 99dxpReWKozc+e8O/axa+AC9prVZHFvAJwxhZ5Z13ysWNFNI1xqtcaVjTdQmqu6z Y1MHdGtwNGpmPKpA7M0ULCL2ceQ1xI25ISxpg9FtDHkQs7hoa6W3P7lFV/SAtr9T lW180hrcm8wLF3lsACyqPIePkkic8wWXeFmLLUARF/MeyjYWZCS161ZmOnbgELVh hgRUrf8I/8qkk3ovlPTCVUM6OdOHDp7Ra3XpSxcece+QvxkYgnjRW+U6ZD0lvxJf Ay5rRgYmU3YU0KDANVgrNSYAIv4hGD3AyocCinxP4Hu/NcjFBQMvyOfpNUKv3ovY /SBI2PKDIb6eERJ3MJJGdw1iOWn96lPvP1UWam9R/zk632ChzoEIimPDTsZsVVj4 zAxxUQ== ----------------------------------------------------------------------------------------- We will use the data gathered from your systems in future campaigns in 14 days !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

  • http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F08BC80F5965BF97

  • http://decoder.re/F08BC80F5965BF97

Signatures

  • Family: Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 11 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\v2.exe
    "C:\Users\Admin\AppData\Local\Temp\v2.exe"
    1⤵
    • Creates a file in the Startup directory
    • Enumerates connected drives
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:5536
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:1148
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5848
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k GPSvcGroup
      1⤵
        PID:3372

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            17wei5u4-readme.txt
            • Path C:\Recovery\17wei5u4-readme.txt
            • Size 7KB
            • SHA256 9af2024749dae3702c7db7f0df5e25bbf0bdf860ada58b94fb7c195aadbedb93
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download