gandcrab | fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2

General

Target

fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
Size

171KB
MD5

94eeb368a6bedc0fc4fc6fca0a0301ad
SHA1

4d7ee3c2115bdcaddd372da5ccef8d9286b1b2fb
SHA256

fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2
SHA512

299122e63d02c809249857b57f7fedded4fe8e031cf6dc680faaad06a3265843b566842eec1f68af28ea787d2e0c36b2b31228d9493fd744e6354e8e2871fd82

Score

10^/10

gandcrab backdoor persistence ransomware

Malware Config

Signatures

GandCrab Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3904-115-0x0000000002390000-0x00000000023A7000-memory.dmp	family_gandcrab

Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\aqbanqcqjij = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\bsvtrx.exe\""	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe

description	ioc	process
File opened (read-only)	\??\E:	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
File opened (read-only)	\??\G:	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
File opened (read-only)	\??\I:	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
File opened (read-only)	\??\O:	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
File opened (read-only)	\??\Q:	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
File opened (read-only)	\??\Y:	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
File opened (read-only)	\??\H:	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
File opened (read-only)	\??\K:	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
File opened (read-only)	\??\M:	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
File opened (read-only)	\??\W:	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
File opened (read-only)	\??\Z:	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
File opened (read-only)	\??\B:	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
File opened (read-only)	\??\F:	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
File opened (read-only)	\??\L:	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
File opened (read-only)	\??\P:	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
File opened (read-only)	\??\T:	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
File opened (read-only)	\??\U:	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
File opened (read-only)	\??\V:	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
File opened (read-only)	\??\X:	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
File opened (read-only)	\??\A:	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
File opened (read-only)	\??\J:	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
File opened (read-only)	\??\N:	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
File opened (read-only)	\??\R:	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
File opened (read-only)	\??\S:	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe

pid	process
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe

Suspicious use of SetWindowsHookAW 64 IoCs

Processes:

fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe

pid	process
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe

description	pid	process	target process
PID 3904 wrote to memory of 192	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 192	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 192	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 4008	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 4008	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 4008	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 2100	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 2100	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 2100	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 700	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 700	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 700	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 3928	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 3928	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 3928	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 3780	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 3780	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 3780	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 3180	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 3180	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 3180	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 3328	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 3328	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 3328	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 2632	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 2632	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 2632	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 2224	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 2224	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 2224	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 3700	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 3700	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 3700	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 3056	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 3056	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 3056	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 3936	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 3936	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 3936	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 1776	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 1776	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 1776	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 1236	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 1236	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 1236	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 3932	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 3932	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 3932	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 1540	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 1540	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 1540	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 2644	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 2644	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 2644	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 3336	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 3336	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 3336	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 3204	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 3204	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 3204	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 1392	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 1392	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 1392	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe
PID 3904 wrote to memory of 648	3904	fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe	nslookup.exe

C:\Users\Admin\AppData\Local\Temp\fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe
"C:\Users\Admin\AppData\Local\Temp\fdc88181e8a29e2bbffa270a299d93929c92bf0b8a60dd6019f900d03f8584a2.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookAW
- Suspicious use of WriteProcessMemory
PID:3904

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:192

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:4008

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:2100

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:700

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:3928

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:3780

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:3180

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:3328

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:2632

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:2224

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:3700

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:3056

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:3936

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1776

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1236

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:3932

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1540

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:2644

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:3336

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:3204

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1392

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:648

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:3856

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:2132

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:3508

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:4032

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:3472

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:2220

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:2708

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:344

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1768

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:4004

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:3520

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:3772

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:200

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:3168

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:2208

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:2120

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:3040

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:3684

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1612

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:2724

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1000

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:3732

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1436

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1812

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:2728

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:2280

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1408

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:2168

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:792

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:3980

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:2856

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:2412

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1156

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1260

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:2640

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:2320

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:2628

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:2292

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:2684

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:756

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:500

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1900

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:2252

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:3872

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1588

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:2284

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:2268

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:3536

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:692

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1028

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:2732

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1192

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:3956

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1100

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:2716

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:2988

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:2488

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1476

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1004

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:4092

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1800

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:2752

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:912

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1732

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1292

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:2720

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1520

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/192-116-0x0000000000000000-mapping.dmp

Download
memory/200-150-0x0000000000000000-mapping.dmp

Download
memory/344-145-0x0000000000000000-mapping.dmp

Download
memory/500-178-0x0000000000000000-mapping.dmp

Download
memory/648-137-0x0000000000000000-mapping.dmp

Download
memory/700-119-0x0000000000000000-mapping.dmp

Download
memory/756-177-0x0000000000000000-mapping.dmp

Download
memory/792-166-0x0000000000000000-mapping.dmp

Download
memory/1000-158-0x0000000000000000-mapping.dmp

Download
memory/1156-170-0x0000000000000000-mapping.dmp

Download
memory/1236-130-0x0000000000000000-mapping.dmp

Download
memory/1260-171-0x0000000000000000-mapping.dmp

Download
memory/1392-136-0x0000000000000000-mapping.dmp

Download
memory/1408-164-0x0000000000000000-mapping.dmp

Download
memory/1436-160-0x0000000000000000-mapping.dmp

Download
memory/1540-132-0x0000000000000000-mapping.dmp

Download
memory/1612-156-0x0000000000000000-mapping.dmp

Download
memory/1768-146-0x0000000000000000-mapping.dmp

Download
memory/1776-129-0x0000000000000000-mapping.dmp

Download
memory/1812-161-0x0000000000000000-mapping.dmp

Download
memory/1900-179-0x0000000000000000-mapping.dmp

Download
memory/2100-118-0x0000000000000000-mapping.dmp

Download
memory/2120-153-0x0000000000000000-mapping.dmp

Download
memory/2132-139-0x0000000000000000-mapping.dmp

Download
memory/2168-165-0x0000000000000000-mapping.dmp

Download
memory/2208-152-0x0000000000000000-mapping.dmp

Download
memory/2220-143-0x0000000000000000-mapping.dmp

Download
memory/2224-125-0x0000000000000000-mapping.dmp

Download
memory/2280-163-0x0000000000000000-mapping.dmp

Download
memory/2292-175-0x0000000000000000-mapping.dmp

Download
memory/2320-173-0x0000000000000000-mapping.dmp

Download
memory/2412-169-0x0000000000000000-mapping.dmp

Download
memory/2628-174-0x0000000000000000-mapping.dmp

Download
memory/2632-124-0x0000000000000000-mapping.dmp

Download
memory/2640-172-0x0000000000000000-mapping.dmp

Download
memory/2644-133-0x0000000000000000-mapping.dmp

Download
memory/2684-176-0x0000000000000000-mapping.dmp

Download
memory/2708-144-0x0000000000000000-mapping.dmp

Download
memory/2724-157-0x0000000000000000-mapping.dmp

Download
memory/2728-162-0x0000000000000000-mapping.dmp

Download
memory/2856-168-0x0000000000000000-mapping.dmp

Download
memory/3040-154-0x0000000000000000-mapping.dmp

Download
memory/3056-127-0x0000000000000000-mapping.dmp

Download
memory/3168-151-0x0000000000000000-mapping.dmp

Download
memory/3180-122-0x0000000000000000-mapping.dmp

Download
memory/3204-135-0x0000000000000000-mapping.dmp

Download
memory/3328-123-0x0000000000000000-mapping.dmp

Download
memory/3336-134-0x0000000000000000-mapping.dmp

Download
memory/3472-142-0x0000000000000000-mapping.dmp

Download
memory/3508-140-0x0000000000000000-mapping.dmp

Download
memory/3520-148-0x0000000000000000-mapping.dmp

Download
memory/3684-155-0x0000000000000000-mapping.dmp

Download
memory/3700-126-0x0000000000000000-mapping.dmp

Download
memory/3732-159-0x0000000000000000-mapping.dmp

Download
memory/3772-149-0x0000000000000000-mapping.dmp

Download
memory/3780-121-0x0000000000000000-mapping.dmp

Download
memory/3856-138-0x0000000000000000-mapping.dmp

Download
memory/3904-114-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3904-115-0x0000000002390000-0x00000000023A7000-memory.dmp

Filesize
92KB

Download
memory/3928-120-0x0000000000000000-mapping.dmp

Download
memory/3932-131-0x0000000000000000-mapping.dmp

Download
memory/3936-128-0x0000000000000000-mapping.dmp

Download
memory/3980-167-0x0000000000000000-mapping.dmp

Download
memory/4004-147-0x0000000000000000-mapping.dmp

Download
memory/4008-117-0x0000000000000000-mapping.dmp

Download
memory/4032-141-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads