047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784

General

Target

047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe
Size

69KB
MD5

bbfda7612fa1a5b1bea76ffce63b6bd8
SHA1

baa147ccb3215e52f30651e4a4e81825e8c68a6b
SHA256

047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784
SHA512

13ae023751c52f417779283fd06bc7b20e05af119384e7d0b7ed1cc6397bf4d69782585b9b7db2b00ce07a67b2a0d472ed9cfae63be6d7642a6bacd68faa54a7

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pzwqbljepca = "C:\\Users\\Admin\\AppData\\Local\\Temp\\047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe"	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe

description	ioc	process
File opened (read-only)	\??\H:	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe
File opened (read-only)	\??\Z:	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe
File opened (read-only)	\??\N:	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe
File opened (read-only)	\??\R:	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe
File opened (read-only)	\??\T:	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe
File opened (read-only)	\??\U:	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe
File opened (read-only)	\??\I:	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe
File opened (read-only)	\??\K:	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe
File opened (read-only)	\??\L:	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe
File opened (read-only)	\??\M:	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe
File opened (read-only)	\??\V:	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe
File opened (read-only)	\??\W:	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe
File opened (read-only)	\??\X:	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe
File opened (read-only)	\??\Y:	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe
File opened (read-only)	\??\A:	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe
File opened (read-only)	\??\F:	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe
File opened (read-only)	\??\G:	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe
File opened (read-only)	\??\S:	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe
File opened (read-only)	\??\P:	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe
File opened (read-only)	\??\Q:	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe
File opened (read-only)	\??\B:	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe
File opened (read-only)	\??\E:	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe
File opened (read-only)	\??\J:	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe
File opened (read-only)	\??\O:	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe

pid	process
4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe
4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe
4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe
4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe

description	pid	process	target process
PID 4640 wrote to memory of 3568	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 3568	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 3568	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 3284	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 3284	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 3284	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 3908	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 3908	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 3908	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 3252	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 3252	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 3252	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 840	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 840	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 840	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 888	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 888	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 888	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 1332	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 1332	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 1332	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 1608	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 1608	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 1608	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 2012	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 2012	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 2012	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 4304	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 4304	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 4304	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 3180	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 3180	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 3180	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 4344	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 4344	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 4344	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 4472	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 4472	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 4472	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 2292	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 2292	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 2292	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 2568	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 2568	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 2568	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 3076	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 3076	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 3076	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 4508	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 4508	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 4508	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 4576	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 4576	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 4576	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 212	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 212	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 212	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 2024	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 2024	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 2024	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 1532	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 1532	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 1532	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe
PID 4640 wrote to memory of 1520	4640	047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe	nslookup.exe

C:\Users\Admin\AppData\Local\Temp\047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe
"C:\Users\Admin\AppData\Local\Temp\047d9e46f401f06f008d2c4eafcdbbb0fcf9d34c8abcce30966475397dd46784.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4640

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:3568

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:3284

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:3908

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:3252

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:840

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:888

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1332

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1608

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:2012

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:4304

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:3180

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:4344

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:4472

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:2292

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:2568

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:3076

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:4508

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:4576

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:212

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:2024

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1532

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:1520

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:3084

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:2884

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1820

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:3564

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:3852

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:4148

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:716

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:516

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:880

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1152

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1560

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:1872

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:4672

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:4036

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:4024

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1788

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:4384

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:2252

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:2144

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:2560

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:2976

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:3124

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:4584

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:2476

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:4516

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:2812

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1568

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:4548

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:4812

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:5092

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:2928

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:3344

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:3164

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:4164

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:668

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:4112

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:1004

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:836

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1316

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1604

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:4296

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:4348

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:2164

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:4340

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:4428

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:2856

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:4684

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:2712

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:3964

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:4588

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1976

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:4488

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:2724

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:3128

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:2996

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:4732

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:3088

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:4120

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:2848

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:3392

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:3304

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:440

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:4204

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:4108

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:636

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:1144

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:1836

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:4756

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:2512

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:4092

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:2088

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:4016

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:4332

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:2112

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:2108

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:2540

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:4504

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:4464

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:184

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:4484

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:4532

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1408

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:3116

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:4660

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:4648

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:5084

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:4180

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:3628

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:3340

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:3264

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:580

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:3048

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:928

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:932

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1728

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:1796

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:4764

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1512

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:4440

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1736

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:2544

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:2508

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:3080

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:3640

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:3980

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:2472

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1272

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/212-20-0x0000000000000000-mapping.dmp

Download
memory/516-31-0x0000000000000000-mapping.dmp

Download
memory/668-58-0x0000000000000000-mapping.dmp

Download
memory/716-30-0x0000000000000000-mapping.dmp

Download
memory/836-61-0x0000000000000000-mapping.dmp

Download
memory/840-6-0x0000000000000000-mapping.dmp

Download
memory/880-32-0x0000000000000000-mapping.dmp

Download
memory/888-7-0x0000000000000000-mapping.dmp

Download
memory/1004-60-0x0000000000000000-mapping.dmp

Download
memory/1152-33-0x0000000000000000-mapping.dmp

Download
memory/1316-62-0x0000000000000000-mapping.dmp

Download
memory/1332-8-0x0000000000000000-mapping.dmp

Download
memory/1520-23-0x0000000000000000-mapping.dmp

Download
memory/1532-22-0x0000000000000000-mapping.dmp

Download
memory/1560-34-0x0000000000000000-mapping.dmp

Download
memory/1568-50-0x0000000000000000-mapping.dmp

Download
memory/1604-63-0x0000000000000000-mapping.dmp

Download
memory/1608-9-0x0000000000000000-mapping.dmp

Download
memory/1788-39-0x0000000000000000-mapping.dmp

Download
memory/1820-26-0x0000000000000000-mapping.dmp

Download
memory/1872-35-0x0000000000000000-mapping.dmp

Download
memory/2012-10-0x0000000000000000-mapping.dmp

Download
memory/2024-21-0x0000000000000000-mapping.dmp

Download
memory/2144-42-0x0000000000000000-mapping.dmp

Download
memory/2252-41-0x0000000000000000-mapping.dmp

Download
memory/2292-15-0x0000000000000000-mapping.dmp

Download
memory/2476-47-0x0000000000000000-mapping.dmp

Download
memory/2560-43-0x0000000000000000-mapping.dmp

Download
memory/2568-16-0x0000000000000000-mapping.dmp

Download
memory/2812-49-0x0000000000000000-mapping.dmp

Download
memory/2884-25-0x0000000000000000-mapping.dmp

Download
memory/2928-54-0x0000000000000000-mapping.dmp

Download
memory/2976-44-0x0000000000000000-mapping.dmp

Download
memory/3076-17-0x0000000000000000-mapping.dmp

Download
memory/3084-24-0x0000000000000000-mapping.dmp

Download
memory/3124-45-0x0000000000000000-mapping.dmp

Download
memory/3164-56-0x0000000000000000-mapping.dmp

Download
memory/3180-12-0x0000000000000000-mapping.dmp

Download
memory/3252-5-0x0000000000000000-mapping.dmp

Download
memory/3284-3-0x0000000000000000-mapping.dmp

Download
memory/3344-55-0x0000000000000000-mapping.dmp

Download
memory/3564-27-0x0000000000000000-mapping.dmp

Download
memory/3568-2-0x0000000000000000-mapping.dmp

Download
memory/3852-28-0x0000000000000000-mapping.dmp

Download
memory/3908-4-0x0000000000000000-mapping.dmp

Download
memory/4024-38-0x0000000000000000-mapping.dmp

Download
memory/4036-37-0x0000000000000000-mapping.dmp

Download
memory/4112-59-0x0000000000000000-mapping.dmp

Download
memory/4148-29-0x0000000000000000-mapping.dmp

Download
memory/4164-57-0x0000000000000000-mapping.dmp

Download
memory/4296-64-0x0000000000000000-mapping.dmp

Download
memory/4304-11-0x0000000000000000-mapping.dmp

Download
memory/4344-13-0x0000000000000000-mapping.dmp

Download
memory/4348-65-0x0000000000000000-mapping.dmp

Download
memory/4384-40-0x0000000000000000-mapping.dmp

Download
memory/4472-14-0x0000000000000000-mapping.dmp

Download
memory/4508-18-0x0000000000000000-mapping.dmp

Download
memory/4516-48-0x0000000000000000-mapping.dmp

Download
memory/4548-51-0x0000000000000000-mapping.dmp

Download
memory/4576-19-0x0000000000000000-mapping.dmp

Download
memory/4584-46-0x0000000000000000-mapping.dmp

Download
memory/4672-36-0x0000000000000000-mapping.dmp

Download
memory/4812-52-0x0000000000000000-mapping.dmp

Download
memory/5092-53-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads