c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b

General

Target

c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe
Size

69KB
MD5

b2eeba64441b3b35e9df5c31ed9bb7ca
SHA1

15b41d2281f8025827127f7e143e9918c0523f44
SHA256

c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b
SHA512

ebdb8b649af8f660adf9016b9cdbf81d12f6a0b6db5c15480a43545d286b0223dc1c3445cb90e047ff839b2e872fbc750542d18fbb000894bd9e7a9a26796b40

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\cvzcnbopmjg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe"	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe

description	ioc	process
File opened (read-only)	\??\E:	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe
File opened (read-only)	\??\F:	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe
File opened (read-only)	\??\X:	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe
File opened (read-only)	\??\Z:	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe
File opened (read-only)	\??\A:	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe
File opened (read-only)	\??\B:	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe
File opened (read-only)	\??\R:	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe
File opened (read-only)	\??\U:	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe
File opened (read-only)	\??\W:	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe
File opened (read-only)	\??\V:	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe
File opened (read-only)	\??\Y:	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe
File opened (read-only)	\??\G:	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe
File opened (read-only)	\??\H:	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe
File opened (read-only)	\??\N:	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe
File opened (read-only)	\??\P:	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe
File opened (read-only)	\??\S:	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe
File opened (read-only)	\??\O:	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe
File opened (read-only)	\??\Q:	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe
File opened (read-only)	\??\T:	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe
File opened (read-only)	\??\I:	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe
File opened (read-only)	\??\J:	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe
File opened (read-only)	\??\K:	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe
File opened (read-only)	\??\L:	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe
File opened (read-only)	\??\M:	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe

pid	process
1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe
1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe

description	pid	process	target process
PID 1764 wrote to memory of 1308	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1308	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1308	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1308	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1120	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1120	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1120	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1120	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1708	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1708	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1708	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1708	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 528	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 528	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 528	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 528	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 620	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 620	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 620	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 620	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1220	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1220	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1220	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1220	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1544	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1544	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1544	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1544	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1020	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1020	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1020	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1020	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1624	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1624	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1624	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1624	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1260	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1260	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1260	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1260	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1560	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1560	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1560	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1560	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 412	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 412	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 412	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 412	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1364	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1364	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1364	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1364	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 2044	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 2044	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 2044	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 2044	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 964	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 964	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 964	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 964	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1028	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1028	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1028	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe
PID 1764 wrote to memory of 1028	1764	c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe	nslookup.exe

C:\Users\Admin\AppData\Local\Temp\c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe
"C:\Users\Admin\AppData\Local\Temp\c09c6ebebf311bbe3ac421d286f419e2d0c3707229fa1d936793290f8eeb3a5b.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1764

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1308

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1120

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1708

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:528

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:620

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1220

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1544

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1020

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1624

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:1260

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:1560

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:412

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1364

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:2044

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:964

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:1028

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:1900

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1792

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1392

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1324

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1112

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:944

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:1588

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:916

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:288

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:684

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:368

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:1688

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:1648

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:572

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1380

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1752

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:948

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:1464

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:856

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:612

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1704

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1660

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1480

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:976

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:940

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:328

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:600

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1152

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1084

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:1612

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:384

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1748

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1600

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:932

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1836

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:2008

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:1656

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1320

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1476

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1728

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1356

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:1652

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:1492

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1928

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:816

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1468

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1800

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:1576

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:2036

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1420

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1088

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1536

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1760

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:1692

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:1496

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1636

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:960

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1532

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1824

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:364

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:1832

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1592

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:292

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:928

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1288

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:1072

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:1368

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1916

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1956

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1488

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1740

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:1796

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:1460

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1372

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:548

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:792

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1076

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:1672

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:2012

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1204

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1384

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1932

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:2004

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:1484

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:1844

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1192

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1968

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1788

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:772

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:1756

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:1812

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1700

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1168

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:864

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:900

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:1888

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:1540

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1892

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1924

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:896

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1680

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:1312

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:1100

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1580

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:780

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:972

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:560

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/288-28-0x0000000000000000-mapping.dmp

Download
memory/328-45-0x0000000000000000-mapping.dmp

Download
memory/368-30-0x0000000000000000-mapping.dmp

Download
memory/384-50-0x0000000000000000-mapping.dmp

Download
memory/412-15-0x0000000000000000-mapping.dmp

Download
memory/528-7-0x0000000000000000-mapping.dmp

Download
memory/572-33-0x0000000000000000-mapping.dmp

Download
memory/600-46-0x0000000000000000-mapping.dmp

Download
memory/612-39-0x0000000000000000-mapping.dmp

Download
memory/620-8-0x0000000000000000-mapping.dmp

Download
memory/684-29-0x0000000000000000-mapping.dmp

Download
memory/816-64-0x0000000000000000-mapping.dmp

Download
memory/856-38-0x0000000000000000-mapping.dmp

Download
memory/916-27-0x0000000000000000-mapping.dmp

Download
memory/932-53-0x0000000000000000-mapping.dmp

Download
memory/940-44-0x0000000000000000-mapping.dmp

Download
memory/944-25-0x0000000000000000-mapping.dmp

Download
memory/948-36-0x0000000000000000-mapping.dmp

Download
memory/964-18-0x0000000000000000-mapping.dmp

Download
memory/976-43-0x0000000000000000-mapping.dmp

Download
memory/1020-11-0x0000000000000000-mapping.dmp

Download
memory/1028-19-0x0000000000000000-mapping.dmp

Download
memory/1084-48-0x0000000000000000-mapping.dmp

Download
memory/1112-24-0x0000000000000000-mapping.dmp

Download
memory/1120-5-0x0000000000000000-mapping.dmp

Download
memory/1152-47-0x0000000000000000-mapping.dmp

Download
memory/1220-9-0x0000000000000000-mapping.dmp

Download
memory/1260-13-0x0000000000000000-mapping.dmp

Download
memory/1268-3-0x000007FEF7F80000-0x000007FEF81FA000-memory.dmp

Filesize
2.5MB

Download
memory/1308-4-0x0000000000000000-mapping.dmp

Download
memory/1320-57-0x0000000000000000-mapping.dmp

Download
memory/1324-23-0x0000000000000000-mapping.dmp

Download
memory/1356-60-0x0000000000000000-mapping.dmp

Download
memory/1364-16-0x0000000000000000-mapping.dmp

Download
memory/1380-34-0x0000000000000000-mapping.dmp

Download
memory/1392-22-0x0000000000000000-mapping.dmp

Download
memory/1464-37-0x0000000000000000-mapping.dmp

Download
memory/1468-65-0x0000000000000000-mapping.dmp

Download
memory/1476-58-0x0000000000000000-mapping.dmp

Download
memory/1480-42-0x0000000000000000-mapping.dmp

Download
memory/1492-62-0x0000000000000000-mapping.dmp

Download
memory/1544-10-0x0000000000000000-mapping.dmp

Download
memory/1560-14-0x0000000000000000-mapping.dmp

Download
memory/1576-67-0x0000000000000000-mapping.dmp

Download
memory/1588-26-0x0000000000000000-mapping.dmp

Download
memory/1600-52-0x0000000000000000-mapping.dmp

Download
memory/1612-49-0x0000000000000000-mapping.dmp

Download
memory/1624-12-0x0000000000000000-mapping.dmp

Download
memory/1648-32-0x0000000000000000-mapping.dmp

Download
memory/1652-61-0x0000000000000000-mapping.dmp

Download
memory/1656-56-0x0000000000000000-mapping.dmp

Download
memory/1660-41-0x0000000000000000-mapping.dmp

Download
memory/1688-31-0x0000000000000000-mapping.dmp

Download
memory/1704-40-0x0000000000000000-mapping.dmp

Download
memory/1708-6-0x0000000000000000-mapping.dmp

Download
memory/1728-59-0x0000000000000000-mapping.dmp

Download
memory/1748-51-0x0000000000000000-mapping.dmp

Download
memory/1752-35-0x0000000000000000-mapping.dmp

Download
memory/1764-2-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download
memory/1792-21-0x0000000000000000-mapping.dmp

Download
memory/1800-66-0x0000000000000000-mapping.dmp

Download
memory/1836-54-0x0000000000000000-mapping.dmp

Download
memory/1900-20-0x0000000000000000-mapping.dmp

Download
memory/1928-63-0x0000000000000000-mapping.dmp

Download
memory/2008-55-0x0000000000000000-mapping.dmp

Download
memory/2044-17-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads