Resubmissions
20/10/2026, 07:33
261020-jdl8paaz3k1014/08/2026, 06:40
260814-hfdhwsek811014/08/2026, 06:33
260814-hbh8kswhka1012/08/2026, 13:34
260812-qvey9syarg10Analysis
- max time kernel
151s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
20/10/2026, 07:33
General
- Target 1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e.exe
- Size 910KB
- Sample261020-jdl8paaz3k
- SHA256 1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e
Malware Config
Extracted
-
sodinokibi
-
$2a$12$SKsv8RkaiMRiIv.rk505vOoBpUyZQgGeKVc11LA6kWdQcxENhkyjK
-
7595
-
hiddencitysecrets.com.au
-
groupe-frayssinet.fr
-
rimborsobancario.net
-
vietlawconsultancy.com
-
live-your-life.jp
-
verbisonline.com
-
sachnendoc.com
-
htchorst.nl
-
bridgeloanslenders.com
-
petnest.ir
-
myhealth.net.au
-
gopackapp.com
-
jenniferandersonwriter.com
-
logopaedie-blomberg.de
-
osterberg.fi
-
bierensgebakkramen.nl
-
refluxreducer.com
-
thenewrejuveme.com
-
alvinschwartz.wordpress.com
-
leoben.at
-
net
true
-
pid
$2a$12$SKsv8RkaiMRiIv.rk505vOoBpUyZQgGeKVc11LA6kWdQcxENhkyjK
-
prc
firefox
mydesktopservice
xfssvccon
infopath
visio
encsvc
onenote
ocssd
ocautoupds
excel
agntsvc
outlook
mspub
iconcerto
wordpad
sqbcoreservice
winword
oracle
thunderbird
ocomm
mydesktopqos
steam
dbsnmp
sql
synctime
tbirdconfig
dbeng50
isqlplussvc
msaccess
thebat
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
7595
-
svc
memtas
veeam
sophos
sql
vss
svc$
mepocs
backup
Extracted
-
C:\Program Files (x86)\svtcbf7-readme.txt
-
sodinokibi
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension svtcbf7. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DC702590D99F107E 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/DC702590D99F107E Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: vLVOwTBxSQdVDhpdM3GFAIk1lixVT2a3n7HT6LuuycKwX4CWkV0NtqTSRNBAXsEQ y9dyQV7xSgoDtmQDl8zZT+M9Vwzb8kUfv6eiP7hoHTRKVD9fYxU0YGsV6IzIFM/r XAoZr6/eAxt//Cn4ytV1q5oJU8fE9/Pukul/umYZ7x1FDTKHhYrjH07WXWBbIvyP 68bXdVU3d/2pVlDNYt/ITdrwaHHB7yqdHZp4ySxRdLoG4TnE58eBl1QmnHPcvrUw z00cTKPICRc7LBNg53mLOMck0H0bUagwvgszNXhIEi4Nl2TpDJddLl5dGejvlCC/ 1x2bdpAtWaHIqdmZTfTlJppQoaI6z0JpDgnEKbyYQaTcdI3N6Lkd/4GVeH7SzNpz 4R1ItUmecwCN1s6TEqphg7SfAtl6ten3wAOnxxu3sECXXl+w1B2Y3/cjEPQSUPC5 wk27OsTdj6tSmE5kpbQKWGkqwJ0HjZK4BhIKKwqYWdMLepmGDH8IQLNqT0ANEuQ5 3bnxZSO2eE4XD7Bx1TwO6I6Y+jspj5zpFZ5frwClJ9eoU2a0kWg7bNlNjMDPL6iV kkj+DDjVnqsktsjqCEK+oMP+bJonQ5CXM+vaCMDicB9TUJWoxF8gsa5AaG7A6sdT Lvmoj3UBtpmqb8pojkSHTwTNuFA+WrfuncPOd2wqdG9gy+N8OxH6mKU+JzbctfZ1 vk06s6lQURaDKFF2cBtB+MNd12H5a/xRrGP8zZlxj/ENOOUufnIoanWEgy0P4RDM s7bK35ynkEFwBPHxe7mj3QvG3S0E4AQS3LIPja7H7OgZjvJ4FwlkzOYmh0VP74zD aRUZy7dFiqwKdhbEmm5Gf4IOrntRNMVJfFBlJAdndqKQSAwhHwNe1BBrbbWz1VMh EnkgNbnhFrvto/Pvj1YiKZvM7ULTvccqDbHfNaTI/VuZiAtpS7OIRggHtjSTiULO GFuoB04Ken8tL1Rf9zf15rvG8IYRTYJeSastBnyXIQdTpLxM2MPI8RditwrZDfBd NyxYBVw/jTiaW1eQRx4PASFFVCjcmN2tRlGPEMnXS3hmq4jGIpnO2bvOhZ/TeFcO BQ2TnQPq/TUNmsnvqIe1QEH3JZYojgy0JIFyNPRGxOuZedJHzkEjA+xox2+nx1Jh GzqA2W0SsjsPGi/iI56z6TVlniQ6C/egxp+kxMpv+kOO976+TqW9pULRhiDvHUPv LbddVrV2m8Qx+n97V2Zs7qqsJTjul+fS0WkYPGksTO4SHHM+FO2u6kEprjtHUfyG 8zVgSYca9NNFcJa8klga4GyVrCgZoQBbpie/rkg5zNf3qEUDJ196tyObGzVq8P3D IlXuD+zAGp1Gz8Z/DWqYv4so79f2rl5yCjXdfHtyPR6BrOcuhcca8pGNl2pnhOpj YAY= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DC702590D99F107E
-
http://decoder.re/DC702590D99F107E
Signatures
- Family: Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
- Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Executes a file named after a Windows system binary 1 TTPs 2 IoCs
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Drops file in Program Files directory 36 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies system certificate store 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e.exe"C:\Users\Admin\AppData\Local\Temp\1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe2⤵
- Executes a file named after a Windows system binary
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exeC:\Users\Admin\AppData\Local\Temp\MsMpEng.exe3⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Masquerading
1Match Legitimate Name or Location
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
svtcbf7-readme.txt
MsMpEng.exe
mpsvc.dll
AddExport.vsd
ApproveSplit.html
memory/4636-7-0x00000000008E0000-0x00000000009E0000-memory.dmp
memory/4636-8-0x0000000003450000-0x0000000003471000-memory.dmp
memory/4636-9-0x0000000003450000-0x0000000003471000-memory.dmp
memory/4636-29-0x0000000003450000-0x0000000003471000-memory.dmp
memory/4636-31-0x00000000008E0000-0x00000000009E0000-memory.dmp
memory/4636-139-0x0000000003450000-0x0000000003471000-memory.dmp
memory/4636-677-0x0000000003450000-0x0000000003471000-memory.dmp