8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c

General

Target

8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe
Size

250KB
MD5

44a3d969549583b944897e62f109b4b0
SHA1

b74aed7bbb6013ded048242bd94714469fe02457
SHA256

8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c
SHA512

08092f7b4cd8026172583b57e2569ea787833d6998e4935ca336ff8f728e9b5e9a33f3261f3465f1bf037c0dec4ded2b98809a28b359a950a4410bd49c873b32

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vzvoucgtcqv = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\zntiks.exe\""	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe

description	ioc	process
File opened (read-only)	\??\R:	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe
File opened (read-only)	\??\S:	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe
File opened (read-only)	\??\T:	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe
File opened (read-only)	\??\W:	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe
File opened (read-only)	\??\G:	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe
File opened (read-only)	\??\N:	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe
File opened (read-only)	\??\Q:	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe
File opened (read-only)	\??\V:	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe
File opened (read-only)	\??\X:	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe
File opened (read-only)	\??\Y:	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe
File opened (read-only)	\??\H:	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe
File opened (read-only)	\??\L:	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe
File opened (read-only)	\??\M:	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe
File opened (read-only)	\??\J:	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe
File opened (read-only)	\??\K:	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe
File opened (read-only)	\??\O:	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe
File opened (read-only)	\??\Z:	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe
File opened (read-only)	\??\A:	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe
File opened (read-only)	\??\B:	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe
File opened (read-only)	\??\I:	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe
File opened (read-only)	\??\U:	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe
File opened (read-only)	\??\E:	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe
File opened (read-only)	\??\F:	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe
File opened (read-only)	\??\P:	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe

pid	process
3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe
3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe
3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe
3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe

description	pid	process	target process
PID 3952 wrote to memory of 192	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 192	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 192	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 1548	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 1548	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 1548	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 3260	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 3260	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 3260	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 3712	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 3712	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 3712	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 604	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 604	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 604	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 3960	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 3960	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 3960	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 2808	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 2808	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 2808	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 3436	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 3436	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 3436	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 2192	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 2192	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 2192	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 1832	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 1832	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 1832	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 1112	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 1112	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 1112	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 1468	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 1468	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 1468	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 3692	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 3692	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 3692	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 1156	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 1156	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 1156	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 3936	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 3936	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 3936	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 1912	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 1912	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 1912	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 4000	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 4000	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 4000	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 1820	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 1820	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 1820	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 932	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 932	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 932	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 1240	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 1240	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 1240	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 2820	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 2820	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 2820	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe
PID 3952 wrote to memory of 1152	3952	8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe	nslookup.exe

C:\Users\Admin\AppData\Local\Temp\8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe
"C:\Users\Admin\AppData\Local\Temp\8a2a3fb2e28d34f79ea7cada58f6f591ac3a0dfa6d3aa38f01f89dfad3d4f36c.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3952

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:192

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:1548

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:3260

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:3712

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:604

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:3960

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:2808

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:3436

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:2192

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:1832

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:1112

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:1468

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:3692

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:1156

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:3936

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:1912

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:4000

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:1820

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:932

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:1240

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:2820

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:1152

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:2172

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:2104

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:2476

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:4052

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:2968

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:1776

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:2720

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:3680

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:2288

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:3808

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:3864

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:3896

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:3024

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:3508

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:2352

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:3732

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:2244

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:3208

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:2164

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:3440

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:3940

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:2100

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:2812

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:3004

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:4092

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:3880

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:3800

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:3332

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:3432

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:2064

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:3964

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:2816

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:3632

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:1812

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:3140

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:1856

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:3212

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:1584

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:3972

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:2784

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:1464

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:2320

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:1716

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:472

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:3156

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:628

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:3236

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:2144

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:3488

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:3728

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:4020

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:2664

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:3092

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:1764

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:3144

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:1828

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:808

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:1128

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:3784

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:3816

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:3148

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:2376

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:3280

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:2432

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:1940

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:1920

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:1472

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:3948

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:3788

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:1576

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:1768

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:1516

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:2436

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:8

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:3368

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:2824

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:3548

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:408

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:2744

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:3796

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:988

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:2060

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:424

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:1132

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:196

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:3904

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:2928

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:852

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:1296

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:3768

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:68

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:1380

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:1264

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/192-116-0x0000000000000000-mapping.dmp

Download
memory/604-120-0x0000000000000000-mapping.dmp

Download
memory/932-134-0x0000000000000000-mapping.dmp

Download
memory/1112-126-0x0000000000000000-mapping.dmp

Download
memory/1152-137-0x0000000000000000-mapping.dmp

Download
memory/1156-129-0x0000000000000000-mapping.dmp

Download
memory/1240-135-0x0000000000000000-mapping.dmp

Download
memory/1464-178-0x0000000000000000-mapping.dmp

Download
memory/1468-127-0x0000000000000000-mapping.dmp

Download
memory/1548-117-0x0000000000000000-mapping.dmp

Download
memory/1584-175-0x0000000000000000-mapping.dmp

Download
memory/1776-143-0x0000000000000000-mapping.dmp

Download
memory/1812-171-0x0000000000000000-mapping.dmp

Download
memory/1820-133-0x0000000000000000-mapping.dmp

Download
memory/1832-125-0x0000000000000000-mapping.dmp

Download
memory/1856-173-0x0000000000000000-mapping.dmp

Download
memory/1912-131-0x0000000000000000-mapping.dmp

Download
memory/2064-167-0x0000000000000000-mapping.dmp

Download
memory/2100-159-0x0000000000000000-mapping.dmp

Download
memory/2104-139-0x0000000000000000-mapping.dmp

Download
memory/2164-156-0x0000000000000000-mapping.dmp

Download
memory/2172-138-0x0000000000000000-mapping.dmp

Download
memory/2192-124-0x0000000000000000-mapping.dmp

Download
memory/2244-154-0x0000000000000000-mapping.dmp

Download
memory/2288-146-0x0000000000000000-mapping.dmp

Download
memory/2320-179-0x0000000000000000-mapping.dmp

Download
memory/2352-152-0x0000000000000000-mapping.dmp

Download
memory/2476-140-0x0000000000000000-mapping.dmp

Download
memory/2720-144-0x0000000000000000-mapping.dmp

Download
memory/2784-177-0x0000000000000000-mapping.dmp

Download
memory/2808-122-0x0000000000000000-mapping.dmp

Download
memory/2812-160-0x0000000000000000-mapping.dmp

Download
memory/2816-169-0x0000000000000000-mapping.dmp

Download
memory/2820-136-0x0000000000000000-mapping.dmp

Download
memory/2968-142-0x0000000000000000-mapping.dmp

Download
memory/3004-161-0x0000000000000000-mapping.dmp

Download
memory/3024-150-0x0000000000000000-mapping.dmp

Download
memory/3140-172-0x0000000000000000-mapping.dmp

Download
memory/3208-155-0x0000000000000000-mapping.dmp

Download
memory/3212-174-0x0000000000000000-mapping.dmp

Download
memory/3260-118-0x0000000000000000-mapping.dmp

Download
memory/3332-165-0x0000000000000000-mapping.dmp

Download
memory/3432-166-0x0000000000000000-mapping.dmp

Download
memory/3436-123-0x0000000000000000-mapping.dmp

Download
memory/3440-157-0x0000000000000000-mapping.dmp

Download
memory/3508-151-0x0000000000000000-mapping.dmp

Download
memory/3632-170-0x0000000000000000-mapping.dmp

Download
memory/3680-145-0x0000000000000000-mapping.dmp

Download
memory/3692-128-0x0000000000000000-mapping.dmp

Download
memory/3712-119-0x0000000000000000-mapping.dmp

Download
memory/3732-153-0x0000000000000000-mapping.dmp

Download
memory/3800-164-0x0000000000000000-mapping.dmp

Download
memory/3808-147-0x0000000000000000-mapping.dmp

Download
memory/3864-148-0x0000000000000000-mapping.dmp

Download
memory/3880-163-0x0000000000000000-mapping.dmp

Download
memory/3896-149-0x0000000000000000-mapping.dmp

Download
memory/3936-130-0x0000000000000000-mapping.dmp

Download
memory/3940-158-0x0000000000000000-mapping.dmp

Download
memory/3952-114-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3952-115-0x00000000004C0000-0x000000000056E000-memory.dmp

Filesize
696KB

Download
memory/3960-121-0x0000000000000000-mapping.dmp

Download
memory/3964-168-0x0000000000000000-mapping.dmp

Download
memory/3972-176-0x0000000000000000-mapping.dmp

Download
memory/4000-132-0x0000000000000000-mapping.dmp

Download
memory/4052-141-0x0000000000000000-mapping.dmp

Download
memory/4092-162-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads