69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11

General

Target

69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe
Size

276KB
MD5

4babc9d5bf67660a72ce9bdcd764fcd3
SHA1

3840a28d1472c2d3861f085c4290226698ef386a
SHA256

69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11
SHA512

1c4300b2bceba60c78484d585d0a525cfce08eed245334d62ef70d246ffcdddeebee73c3fbd6201f3e7b3b6a8380c944d56f5c4e203291447ac98654ba13f79e

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\gthwvdlxdyo = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\hhnopk.exe\""	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe

description	ioc	process
File opened (read-only)	\??\O:	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe
File opened (read-only)	\??\P:	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe
File opened (read-only)	\??\S:	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe
File opened (read-only)	\??\E:	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe
File opened (read-only)	\??\F:	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe
File opened (read-only)	\??\G:	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe
File opened (read-only)	\??\J:	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe
File opened (read-only)	\??\K:	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe
File opened (read-only)	\??\W:	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe
File opened (read-only)	\??\A:	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe
File opened (read-only)	\??\H:	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe
File opened (read-only)	\??\I:	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe
File opened (read-only)	\??\X:	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe
File opened (read-only)	\??\Y:	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe
File opened (read-only)	\??\Z:	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe
File opened (read-only)	\??\B:	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe
File opened (read-only)	\??\T:	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe
File opened (read-only)	\??\U:	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe
File opened (read-only)	\??\Q:	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe
File opened (read-only)	\??\R:	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe
File opened (read-only)	\??\V:	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe
File opened (read-only)	\??\L:	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe
File opened (read-only)	\??\M:	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe
File opened (read-only)	\??\N:	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe

pid	process
1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe
1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe
1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe
1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe

description	pid	process	target process
PID 1908 wrote to memory of 3924	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 3924	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 3924	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 1116	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 1116	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 1116	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 4076	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 4076	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 4076	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 3996	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 3996	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 3996	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 1392	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 1392	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 1392	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 1256	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 1256	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 1256	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 2720	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 2720	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 2720	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 2804	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 2804	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 2804	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 4052	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 4052	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 4052	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 3744	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 3744	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 3744	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 3936	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 3936	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 3936	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 200	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 200	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 200	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 1684	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 1684	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 1684	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 2696	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 2696	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 2696	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 2768	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 2768	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 2768	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 3404	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 3404	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 3404	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 2236	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 2236	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 2236	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 8	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 8	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 8	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 2672	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 2672	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 2672	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 1660	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 1660	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 1660	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 1592	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 1592	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 1592	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe
PID 1908 wrote to memory of 2688	1908	69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe	nslookup.exe

C:\Users\Admin\AppData\Local\Temp\69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe
"C:\Users\Admin\AppData\Local\Temp\69b050b2a7b33b6471180bef7180272614420fcdd3014f46ccca1d1998c86b11.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1908

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:3924

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1116

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:4076

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:3996

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1392

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1256

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:2720

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:2804

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:4052

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:3744

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:3936

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:200

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1684

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:2696

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:2768

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:3404

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:2236

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:8

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:2672

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1660

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1592

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:2688

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1780

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:3844

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:2864

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:2212

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:2260

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:2124

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:212

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:4012

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:2728

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:2288

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:3252

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:3092

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:3516

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:2044

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:788

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:2676

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1488

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:2668

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:2452

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:3168

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:4072

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1480

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:764

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1484

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:2540

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:3412

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:3684

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:3904

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:524

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:4056

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:3356

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:612

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:4032

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:376

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:3720

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1308

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:2764

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1776

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:3332

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:204

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:196

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:3292

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:760

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:2404

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1016

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:2324

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1448

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1476

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:4044

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:780

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:224

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1584

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1688

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:3264

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:2468

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:2884

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:3732

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:3364

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1384

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:2240

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1176

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:2740

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:2316

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1516

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:3120

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:3932

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:3908

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1412

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:4048

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:3988

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:3580

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1524

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:2208

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1860

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:2724

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:716

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1172

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:2528

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:3948

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:2284

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:2272

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1772

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:3624

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1020

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1748

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1952

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:3076

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:3728

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:3648

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:2736

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:832

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:660

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:3760

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:880

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:3832

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1332

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:432

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:2116

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/8-133-0x0000000000000000-mapping.dmp

Download
memory/196-178-0x0000000000000000-mapping.dmp

Download
memory/200-127-0x0000000000000000-mapping.dmp

Download
memory/204-177-0x0000000000000000-mapping.dmp

Download
memory/212-144-0x0000000000000000-mapping.dmp

Download
memory/376-171-0x0000000000000000-mapping.dmp

Download
memory/524-166-0x0000000000000000-mapping.dmp

Download
memory/612-169-0x0000000000000000-mapping.dmp

Download
memory/764-160-0x0000000000000000-mapping.dmp

Download
memory/788-152-0x0000000000000000-mapping.dmp

Download
memory/1116-117-0x0000000000000000-mapping.dmp

Download
memory/1256-121-0x0000000000000000-mapping.dmp

Download
memory/1308-173-0x0000000000000000-mapping.dmp

Download
memory/1392-120-0x0000000000000000-mapping.dmp

Download
memory/1480-159-0x0000000000000000-mapping.dmp

Download
memory/1484-161-0x0000000000000000-mapping.dmp

Download
memory/1488-154-0x0000000000000000-mapping.dmp

Download
memory/1592-136-0x0000000000000000-mapping.dmp

Download
memory/1660-135-0x0000000000000000-mapping.dmp

Download
memory/1684-128-0x0000000000000000-mapping.dmp

Download
memory/1776-175-0x0000000000000000-mapping.dmp

Download
memory/1780-138-0x0000000000000000-mapping.dmp

Download
memory/1908-114-0x0000000000400000-0x00000000009F7000-memory.dmp

Filesize
6.0MB

Download
memory/1908-115-0x0000000000A00000-0x0000000000B4A000-memory.dmp

Filesize
1.3MB

Download
memory/2044-151-0x0000000000000000-mapping.dmp

Download
memory/2124-143-0x0000000000000000-mapping.dmp

Download
memory/2212-141-0x0000000000000000-mapping.dmp

Download
memory/2236-132-0x0000000000000000-mapping.dmp

Download
memory/2260-142-0x0000000000000000-mapping.dmp

Download
memory/2288-147-0x0000000000000000-mapping.dmp

Download
memory/2452-156-0x0000000000000000-mapping.dmp

Download
memory/2540-162-0x0000000000000000-mapping.dmp

Download
memory/2668-155-0x0000000000000000-mapping.dmp

Download
memory/2672-134-0x0000000000000000-mapping.dmp

Download
memory/2676-153-0x0000000000000000-mapping.dmp

Download
memory/2688-137-0x0000000000000000-mapping.dmp

Download
memory/2696-129-0x0000000000000000-mapping.dmp

Download
memory/2720-122-0x0000000000000000-mapping.dmp

Download
memory/2728-146-0x0000000000000000-mapping.dmp

Download
memory/2764-174-0x0000000000000000-mapping.dmp

Download
memory/2768-130-0x0000000000000000-mapping.dmp

Download
memory/2804-123-0x0000000000000000-mapping.dmp

Download
memory/2864-140-0x0000000000000000-mapping.dmp

Download
memory/3092-149-0x0000000000000000-mapping.dmp

Download
memory/3168-157-0x0000000000000000-mapping.dmp

Download
memory/3252-148-0x0000000000000000-mapping.dmp

Download
memory/3292-179-0x0000000000000000-mapping.dmp

Download
memory/3332-176-0x0000000000000000-mapping.dmp

Download
memory/3356-168-0x0000000000000000-mapping.dmp

Download
memory/3404-131-0x0000000000000000-mapping.dmp

Download
memory/3412-163-0x0000000000000000-mapping.dmp

Download
memory/3516-150-0x0000000000000000-mapping.dmp

Download
memory/3684-164-0x0000000000000000-mapping.dmp

Download
memory/3720-172-0x0000000000000000-mapping.dmp

Download
memory/3744-125-0x0000000000000000-mapping.dmp

Download
memory/3844-139-0x0000000000000000-mapping.dmp

Download
memory/3904-165-0x0000000000000000-mapping.dmp

Download
memory/3924-116-0x0000000000000000-mapping.dmp

Download
memory/3936-126-0x0000000000000000-mapping.dmp

Download
memory/3996-119-0x0000000000000000-mapping.dmp

Download
memory/4012-145-0x0000000000000000-mapping.dmp

Download
memory/4032-170-0x0000000000000000-mapping.dmp

Download
memory/4052-124-0x0000000000000000-mapping.dmp

Download
memory/4056-167-0x0000000000000000-mapping.dmp

Download
memory/4072-158-0x0000000000000000-mapping.dmp

Download
memory/4076-118-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads