035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82

General

Target

035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
Size

241KB
MD5

625f35558bdbe0f99bbaaae94d34732a
SHA1

a04316dceebf4de5d6716b2ce5be5c1c29f2d422
SHA256

035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82
SHA512

e4a342db8d60a30285d4fe82a6675f66db60ad2d8571b86c02de63ba21067cbfafc709cf23283dc4eb686e0bbf9d5f016110ac0a2e3811a26eb181aa1a9477d9

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zdclxbaebxh = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\ymehij.exe\""	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe

description	ioc	process
File opened (read-only)	\??\N:	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
File opened (read-only)	\??\P:	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
File opened (read-only)	\??\R:	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
File opened (read-only)	\??\S:	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
File opened (read-only)	\??\T:	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
File opened (read-only)	\??\B:	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
File opened (read-only)	\??\F:	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
File opened (read-only)	\??\I:	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
File opened (read-only)	\??\V:	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
File opened (read-only)	\??\Z:	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
File opened (read-only)	\??\A:	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
File opened (read-only)	\??\H:	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
File opened (read-only)	\??\K:	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
File opened (read-only)	\??\U:	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
File opened (read-only)	\??\W:	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
File opened (read-only)	\??\Y:	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
File opened (read-only)	\??\J:	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
File opened (read-only)	\??\M:	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
File opened (read-only)	\??\O:	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
File opened (read-only)	\??\Q:	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
File opened (read-only)	\??\X:	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
File opened (read-only)	\??\E:	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
File opened (read-only)	\??\G:	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
File opened (read-only)	\??\L:	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe

Drops file in Windows directory 1 IoCs

Processes:

035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe

description ioc process

File opened for modification C:\Windows\win.ini 035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe

description	ioc	process
File opened for modification	C:\Windows\win.ini	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\UpperFilters	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\LowerFilters	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\UpperFilters	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\LowerFilters	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe

pid	process
4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

Processes:

035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe

description	pid	process
Token: SeLoadDriverPrivilege	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
Token: SeLoadDriverPrivilege	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
Token: SeLoadDriverPrivilege	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
Token: SeLoadDriverPrivilege	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
Token: SeLoadDriverPrivilege	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
Token: SeLoadDriverPrivilege	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
Token: SeLoadDriverPrivilege	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
Token: SeLoadDriverPrivilege	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
Token: SeLoadDriverPrivilege	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
Token: SeLoadDriverPrivilege	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
Token: SeLoadDriverPrivilege	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
Token: SeLoadDriverPrivilege	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
Token: SeLoadDriverPrivilege	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
Token: SeLoadDriverPrivilege	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
Token: SeLoadDriverPrivilege	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
Token: SeLoadDriverPrivilege	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
Token: SeLoadDriverPrivilege	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
Token: SeLoadDriverPrivilege	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
Token: SeLoadDriverPrivilege	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
Token: SeLoadDriverPrivilege	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
Token: SeLoadDriverPrivilege	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
Token: SeLoadDriverPrivilege	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
Token: SeLoadDriverPrivilege	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
Token: SeLoadDriverPrivilege	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
Token: SeLoadDriverPrivilege	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
Token: SeLoadDriverPrivilege	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
Token: SeLoadDriverPrivilege	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
Token: SeLoadDriverPrivilege	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
Token: SeLoadDriverPrivilege	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
Token: SeLoadDriverPrivilege	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe

description	pid	process	target process
PID 4024 wrote to memory of 3988	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 3988	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 3988	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 2512	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 2512	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 2512	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 2956	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 2956	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 2956	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 732	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 732	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 732	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 1220	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 1220	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 1220	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 2508	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 2508	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 2508	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 2160	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 2160	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 2160	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 2604	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 2604	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 2604	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 4016	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 4016	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 4016	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 764	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 764	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 764	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 1392	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 1392	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 1392	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 1384	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 1384	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 1384	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 2240	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 2240	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 2240	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 1664	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 1664	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 1664	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 1788	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 1788	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 1788	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 792	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 792	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 792	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 2544	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 2544	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 2544	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 2692	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 2692	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 2692	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 1316	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 1316	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 1316	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 3356	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 3356	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 3356	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 3612	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 3612	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 3612	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe
PID 4024 wrote to memory of 3604	4024	035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe	nslookup.exe

C:\Users\Admin\AppData\Local\Temp\035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe
"C:\Users\Admin\AppData\Local\Temp\035e9c14bcd35ae35d8c33124504538cde125ff055fce62c0286d6292a3e7f82.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4024

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:3988

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:2512

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:2956

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:732

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:1220

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:2508

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:2160

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:2604

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:4016

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:764

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:1392

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:1384

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:2240

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:1664

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:1788

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:792

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:2544

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:2692

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:1316

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:3356

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:3612

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:3604

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:1724

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:2184

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:3896

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:2828

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:1944

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:2076

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:3096

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:2696

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:1540

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:3564

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:1904

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:2872

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:1092

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:424

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:3376

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:2124

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:3212

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:2688

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:1848

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:2612

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:2096

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:1864

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:3976

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:2592

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:3332

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:1596

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:204

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:684

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:2204

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:2060

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:628

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:2608

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:2652

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:1184

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:3496

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:4036

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:1268

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:192

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:1416

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:2372

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:2772

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:2568

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:2132

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:1784

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:4012

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:3080

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:3296

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:3236

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:2732

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:3204

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:3712

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:1088

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:1452

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:2836

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:3300

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:1012

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:3980

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:1968

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:2712

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:1448

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:3248

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:3244

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:2620

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:4032

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:3964

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:4048

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:188

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:2572

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:3216

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:2616

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:1700

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:3720

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:2660

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:3740

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:184

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:2328

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:3188

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:3944

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:2596

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:408

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:2524

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:2868

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:916

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:3792

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:3676

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:2516

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:2588

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:416

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:4052

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:2120

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:1412

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:2172

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:3220

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:3404

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:2368

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:3100

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:2072

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:1600

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:2168

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:2200

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:1616

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:3636

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:4000

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:3652

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

3

T1012

Peripheral Device Discovery

2

T1120

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/192-175-0x0000000000000000-mapping.dmp

Download
memory/204-164-0x0000000000000000-mapping.dmp

Download
memory/424-151-0x0000000000000000-mapping.dmp

Download
memory/628-168-0x0000000000000000-mapping.dmp

Download
memory/684-165-0x0000000000000000-mapping.dmp

Download
memory/732-119-0x0000000000000000-mapping.dmp

Download
memory/764-125-0x0000000000000000-mapping.dmp

Download
memory/792-131-0x0000000000000000-mapping.dmp

Download
memory/1092-150-0x0000000000000000-mapping.dmp

Download
memory/1184-171-0x0000000000000000-mapping.dmp

Download
memory/1220-120-0x0000000000000000-mapping.dmp

Download
memory/1268-174-0x0000000000000000-mapping.dmp

Download
memory/1316-134-0x0000000000000000-mapping.dmp

Download
memory/1384-127-0x0000000000000000-mapping.dmp

Download
memory/1392-126-0x0000000000000000-mapping.dmp

Download
memory/1416-176-0x0000000000000000-mapping.dmp

Download
memory/1540-146-0x0000000000000000-mapping.dmp

Download
memory/1596-163-0x0000000000000000-mapping.dmp

Download
memory/1664-129-0x0000000000000000-mapping.dmp

Download
memory/1724-138-0x0000000000000000-mapping.dmp

Download
memory/1788-130-0x0000000000000000-mapping.dmp

Download
memory/1848-156-0x0000000000000000-mapping.dmp

Download
memory/1864-159-0x0000000000000000-mapping.dmp

Download
memory/1904-148-0x0000000000000000-mapping.dmp

Download
memory/1944-142-0x0000000000000000-mapping.dmp

Download
memory/2060-167-0x0000000000000000-mapping.dmp

Download
memory/2076-143-0x0000000000000000-mapping.dmp

Download
memory/2096-158-0x0000000000000000-mapping.dmp

Download
memory/2124-153-0x0000000000000000-mapping.dmp

Download
memory/2160-122-0x0000000000000000-mapping.dmp

Download
memory/2184-139-0x0000000000000000-mapping.dmp

Download
memory/2204-166-0x0000000000000000-mapping.dmp

Download
memory/2240-128-0x0000000000000000-mapping.dmp

Download
memory/2372-177-0x0000000000000000-mapping.dmp

Download
memory/2508-121-0x0000000000000000-mapping.dmp

Download
memory/2512-117-0x0000000000000000-mapping.dmp

Download
memory/2544-132-0x0000000000000000-mapping.dmp

Download
memory/2568-179-0x0000000000000000-mapping.dmp

Download
memory/2592-161-0x0000000000000000-mapping.dmp

Download
memory/2604-123-0x0000000000000000-mapping.dmp

Download
memory/2608-169-0x0000000000000000-mapping.dmp

Download
memory/2612-157-0x0000000000000000-mapping.dmp

Download
memory/2652-170-0x0000000000000000-mapping.dmp

Download
memory/2688-155-0x0000000000000000-mapping.dmp

Download
memory/2692-133-0x0000000000000000-mapping.dmp

Download
memory/2696-145-0x0000000000000000-mapping.dmp

Download
memory/2772-178-0x0000000000000000-mapping.dmp

Download
memory/2828-141-0x0000000000000000-mapping.dmp

Download
memory/2872-149-0x0000000000000000-mapping.dmp

Download
memory/2956-118-0x0000000000000000-mapping.dmp

Download
memory/3096-144-0x0000000000000000-mapping.dmp

Download
memory/3212-154-0x0000000000000000-mapping.dmp

Download
memory/3332-162-0x0000000000000000-mapping.dmp

Download
memory/3356-135-0x0000000000000000-mapping.dmp

Download
memory/3376-152-0x0000000000000000-mapping.dmp

Download
memory/3496-172-0x0000000000000000-mapping.dmp

Download
memory/3564-147-0x0000000000000000-mapping.dmp

Download
memory/3604-137-0x0000000000000000-mapping.dmp

Download
memory/3612-136-0x0000000000000000-mapping.dmp

Download
memory/3896-140-0x0000000000000000-mapping.dmp

Download
memory/3976-160-0x0000000000000000-mapping.dmp

Download
memory/3988-116-0x0000000000000000-mapping.dmp

Download
memory/4016-124-0x0000000000000000-mapping.dmp

Download
memory/4024-114-0x0000000000400000-0x0000000000B4C000-memory.dmp

Filesize
7.3MB

Download
memory/4024-115-0x0000000000C70000-0x0000000000DBA000-memory.dmp

Filesize
1.3MB

Download
memory/4036-173-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads