2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6

General

Target

2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe
Size

207KB
MD5

08d9daa90cacc71bd3f96e056699e318
SHA1

e048e8bde75f2660fd6eb8c834da4b895f943d02
SHA256

2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6
SHA512

930fb50777ae4938ed43d42a7a3188cb0f0015da8a8816b8714dc35b91397b59fc770bb0beae858cb99ceabc7118d21079cce564b56db62b790f175aa5b32ca5

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\hybeyolmcci = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe"	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe

description	ioc	process
File opened (read-only)	\??\E:	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe
File opened (read-only)	\??\K:	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe
File opened (read-only)	\??\M:	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe
File opened (read-only)	\??\U:	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe
File opened (read-only)	\??\P:	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe
File opened (read-only)	\??\R:	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe
File opened (read-only)	\??\S:	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe
File opened (read-only)	\??\W:	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe
File opened (read-only)	\??\A:	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe
File opened (read-only)	\??\I:	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe
File opened (read-only)	\??\L:	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe
File opened (read-only)	\??\N:	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe
File opened (read-only)	\??\X:	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe
File opened (read-only)	\??\J:	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe
File opened (read-only)	\??\O:	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe
File opened (read-only)	\??\Z:	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe
File opened (read-only)	\??\Q:	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe
File opened (read-only)	\??\T:	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe
File opened (read-only)	\??\V:	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe
File opened (read-only)	\??\Y:	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe
File opened (read-only)	\??\B:	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe
File opened (read-only)	\??\F:	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe
File opened (read-only)	\??\G:	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe
File opened (read-only)	\??\H:	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe

pid	process
1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe
1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe
1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe
1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe

description	pid	process	target process
PID 1824 wrote to memory of 2624	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 2624	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 2624	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 1376	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 1376	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 1376	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 3220	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 3220	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 3220	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 516	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 516	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 516	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 3244	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 3244	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 3244	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 2352	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 2352	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 2352	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 1368	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 1368	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 1368	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 3500	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 3500	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 3500	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 756	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 756	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 756	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 1280	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 1280	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 1280	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 3924	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 3924	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 3924	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 1900	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 1900	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 1900	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 2656	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 2656	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 2656	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 1192	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 1192	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 1192	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 3276	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 3276	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 3276	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 2384	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 2384	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 2384	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 3952	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 3952	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 3952	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 1052	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 1052	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 1052	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 1520	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 1520	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 1520	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 2612	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 2612	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 2612	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 3144	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 3144	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 3144	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe
PID 1824 wrote to memory of 3236	1824	2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe	nslookup.exe

C:\Users\Admin\AppData\Local\Temp\2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe
"C:\Users\Admin\AppData\Local\Temp\2b77d2d1caed4ed2c085f16982d8bb69441e144dd3ee5407c5f78d03e3a158d6.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1824

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns1.virmach.ru
2⤵
PID:2624

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns1.virmach.ru
2⤵
PID:1376

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns2.virmach.ru
2⤵
PID:3220

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns2.virmach.ru
2⤵
PID:516

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns2.virmach.ru
2⤵
PID:3244

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns1.virmach.ru
2⤵
PID:2352

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns1.virmach.ru
2⤵
PID:1368

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns1.virmach.ru
2⤵
PID:3500

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns2.virmach.ru
2⤵
PID:756

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns2.virmach.ru
2⤵
PID:1280

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns2.virmach.ru
2⤵
PID:3924

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns1.virmach.ru
2⤵
PID:1900

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns1.virmach.ru
2⤵
PID:2656

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns1.virmach.ru
2⤵
PID:1192

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns2.virmach.ru
2⤵
PID:3276

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns2.virmach.ru
2⤵
PID:2384

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns2.virmach.ru
2⤵
PID:3952

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns1.virmach.ru
2⤵
PID:1052

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns1.virmach.ru
2⤵
PID:1520

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns1.virmach.ru
2⤵
PID:2612

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns2.virmach.ru
2⤵
PID:3144

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns2.virmach.ru
2⤵
PID:3236

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns2.virmach.ru
2⤵
PID:3532

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns1.virmach.ru
2⤵
PID:3900

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns1.virmach.ru
2⤵
PID:2620

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns1.virmach.ru
2⤵
PID:1524

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns2.virmach.ru
2⤵
PID:188

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns2.virmach.ru
2⤵
PID:1584

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns2.virmach.ru
2⤵
PID:2360

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns1.virmach.ru
2⤵
PID:1716

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns1.virmach.ru
2⤵
PID:1620

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns1.virmach.ru
2⤵
PID:2260

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns2.virmach.ru
2⤵
PID:3284

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns2.virmach.ru
2⤵
PID:1312

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns2.virmach.ru
2⤵
PID:780

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns1.virmach.ru
2⤵
PID:2100

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns1.virmach.ru
2⤵
PID:3856

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns1.virmach.ru
2⤵
PID:3428

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns2.virmach.ru
2⤵
PID:2096

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns2.virmach.ru
2⤵
PID:2208

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns2.virmach.ru
2⤵
PID:2156

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns1.virmach.ru
2⤵
PID:1752

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns1.virmach.ru
2⤵
PID:3704

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns1.virmach.ru
2⤵
PID:1208

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns2.virmach.ru
2⤵
PID:2632

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns2.virmach.ru
2⤵
PID:2652

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns2.virmach.ru
2⤵
PID:3388

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns1.virmach.ru
2⤵
PID:1404

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns1.virmach.ru
2⤵
PID:4032

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns1.virmach.ru
2⤵
PID:2564

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns2.virmach.ru
2⤵
PID:3708

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns2.virmach.ru
2⤵
PID:3084

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns2.virmach.ru
2⤵
PID:3680

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns1.virmach.ru
2⤵
PID:1816

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns1.virmach.ru
2⤵
PID:3268

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns1.virmach.ru
2⤵
PID:3920

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns2.virmach.ru
2⤵
PID:2444

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns2.virmach.ru
2⤵
PID:2276

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns2.virmach.ru
2⤵
PID:3424

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns1.virmach.ru
2⤵
PID:1624

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns1.virmach.ru
2⤵
PID:620

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns1.virmach.ru
2⤵
PID:1364

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns2.virmach.ru
2⤵
PID:2196

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns2.virmach.ru
2⤵
PID:1580

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns2.virmach.ru
2⤵
PID:1800

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns1.virmach.ru
2⤵
PID:3904

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns1.virmach.ru
2⤵
PID:1512

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns1.virmach.ru
2⤵
PID:4040

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns2.virmach.ru
2⤵
PID:2280

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns2.virmach.ru
2⤵
PID:2136

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns2.virmach.ru
2⤵
PID:412

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns1.virmach.ru
2⤵
PID:1532

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns1.virmach.ru
2⤵
PID:2252

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns1.virmach.ru
2⤵
PID:1276

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns2.virmach.ru
2⤵
PID:1356

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns2.virmach.ru
2⤵
PID:3808

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns2.virmach.ru
2⤵
PID:3896

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns1.virmach.ru
2⤵
PID:2616

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns1.virmach.ru
2⤵
PID:2332

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns1.virmach.ru
2⤵
PID:2240

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns2.virmach.ru
2⤵
PID:2120

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns2.virmach.ru
2⤵
PID:2248

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns2.virmach.ru
2⤵
PID:1812

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns1.virmach.ru
2⤵
PID:4012

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns1.virmach.ru
2⤵
PID:3572

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns1.virmach.ru
2⤵
PID:1528

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns2.virmach.ru
2⤵
PID:1864

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns2.virmach.ru
2⤵
PID:3396

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns2.virmach.ru
2⤵
PID:3796

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns1.virmach.ru
2⤵
PID:1892

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns1.virmach.ru
2⤵
PID:3624

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns1.virmach.ru
2⤵
PID:3180

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns2.virmach.ru
2⤵
PID:3956

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns2.virmach.ru
2⤵
PID:2756

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns2.virmach.ru
2⤵
PID:2888

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns1.virmach.ru
2⤵
PID:2992

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns1.virmach.ru
2⤵
PID:2184

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns1.virmach.ru
2⤵
PID:3104

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns2.virmach.ru
2⤵
PID:1292

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns2.virmach.ru
2⤵
PID:2000

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns2.virmach.ru
2⤵
PID:960

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns1.virmach.ru
2⤵
PID:2920

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns1.virmach.ru
2⤵
PID:3328

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns1.virmach.ru
2⤵
PID:512

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns2.virmach.ru
2⤵
PID:3108

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns2.virmach.ru
2⤵
PID:3408

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns2.virmach.ru
2⤵
PID:1772

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns1.virmach.ru
2⤵
PID:1444

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns1.virmach.ru
2⤵
PID:3012

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns1.virmach.ru
2⤵
PID:2032

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns2.virmach.ru
2⤵
PID:1060

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns2.virmach.ru
2⤵
PID:2348

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns2.virmach.ru
2⤵
PID:1536

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns1.virmach.ru
2⤵
PID:588

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns1.virmach.ru
2⤵
PID:3536

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns1.virmach.ru
2⤵
PID:2180

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns2.virmach.ru
2⤵
PID:3324

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/188-142-0x0000000000000000-mapping.dmp

Download
memory/516-119-0x0000000000000000-mapping.dmp

Download
memory/620-176-0x0000000000000000-mapping.dmp

Download
memory/756-124-0x0000000000000000-mapping.dmp

Download
memory/780-150-0x0000000000000000-mapping.dmp

Download
memory/1052-133-0x0000000000000000-mapping.dmp

Download
memory/1192-129-0x0000000000000000-mapping.dmp

Download
memory/1208-159-0x0000000000000000-mapping.dmp

Download
memory/1280-125-0x0000000000000000-mapping.dmp

Download
memory/1312-149-0x0000000000000000-mapping.dmp

Download
memory/1364-177-0x0000000000000000-mapping.dmp

Download
memory/1368-122-0x0000000000000000-mapping.dmp

Download
memory/1376-117-0x0000000000000000-mapping.dmp

Download
memory/1404-163-0x0000000000000000-mapping.dmp

Download
memory/1520-134-0x0000000000000000-mapping.dmp

Download
memory/1524-141-0x0000000000000000-mapping.dmp

Download
memory/1580-179-0x0000000000000000-mapping.dmp

Download
memory/1584-143-0x0000000000000000-mapping.dmp

Download
memory/1620-146-0x0000000000000000-mapping.dmp

Download
memory/1624-175-0x0000000000000000-mapping.dmp

Download
memory/1716-145-0x0000000000000000-mapping.dmp

Download
memory/1752-157-0x0000000000000000-mapping.dmp

Download
memory/1816-169-0x0000000000000000-mapping.dmp

Download
memory/1824-115-0x0000000000450000-0x00000000004FE000-memory.dmp

Filesize
696KB

Download
memory/1824-114-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1900-127-0x0000000000000000-mapping.dmp

Download
memory/2096-154-0x0000000000000000-mapping.dmp

Download
memory/2100-151-0x0000000000000000-mapping.dmp

Download
memory/2156-156-0x0000000000000000-mapping.dmp

Download
memory/2196-178-0x0000000000000000-mapping.dmp

Download
memory/2208-155-0x0000000000000000-mapping.dmp

Download
memory/2260-147-0x0000000000000000-mapping.dmp

Download
memory/2276-173-0x0000000000000000-mapping.dmp

Download
memory/2352-121-0x0000000000000000-mapping.dmp

Download
memory/2360-144-0x0000000000000000-mapping.dmp

Download
memory/2384-131-0x0000000000000000-mapping.dmp

Download
memory/2444-172-0x0000000000000000-mapping.dmp

Download
memory/2564-165-0x0000000000000000-mapping.dmp

Download
memory/2612-135-0x0000000000000000-mapping.dmp

Download
memory/2620-140-0x0000000000000000-mapping.dmp

Download
memory/2624-116-0x0000000000000000-mapping.dmp

Download
memory/2632-160-0x0000000000000000-mapping.dmp

Download
memory/2652-161-0x0000000000000000-mapping.dmp

Download
memory/2656-128-0x0000000000000000-mapping.dmp

Download
memory/3084-167-0x0000000000000000-mapping.dmp

Download
memory/3144-136-0x0000000000000000-mapping.dmp

Download
memory/3220-118-0x0000000000000000-mapping.dmp

Download
memory/3236-137-0x0000000000000000-mapping.dmp

Download
memory/3244-120-0x0000000000000000-mapping.dmp

Download
memory/3268-170-0x0000000000000000-mapping.dmp

Download
memory/3276-130-0x0000000000000000-mapping.dmp

Download
memory/3284-148-0x0000000000000000-mapping.dmp

Download
memory/3388-162-0x0000000000000000-mapping.dmp

Download
memory/3424-174-0x0000000000000000-mapping.dmp

Download
memory/3428-153-0x0000000000000000-mapping.dmp

Download
memory/3500-123-0x0000000000000000-mapping.dmp

Download
memory/3532-138-0x0000000000000000-mapping.dmp

Download
memory/3680-168-0x0000000000000000-mapping.dmp

Download
memory/3704-158-0x0000000000000000-mapping.dmp

Download
memory/3708-166-0x0000000000000000-mapping.dmp

Download
memory/3856-152-0x0000000000000000-mapping.dmp

Download
memory/3900-139-0x0000000000000000-mapping.dmp

Download
memory/3920-171-0x0000000000000000-mapping.dmp

Download
memory/3924-126-0x0000000000000000-mapping.dmp

Download
memory/3952-132-0x0000000000000000-mapping.dmp

Download
memory/4032-164-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads