19a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c

General
Target

19a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe

Filesize

181KB

Completed

19-05-2021 04:02

Score
10/10
MD5

4a12911191d436aa3a2e7760d3ad61a3

SHA1

6ae081144769492edb4dc82a6c3aeeb7bd71583b

SHA256

19a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c

Malware Config
Signatures 8

Filter: none

Defense Evasion
Discovery
Persistence
  • GandCrab Payload

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/1048-62-0x0000000000510000-0x0000000000527000-memory.dmpfamily_gandcrab
  • Gandcrab

    Description

    Gandcrab is a Trojan horse that encrypts files on a computer.

  • Adds Run key to start application
    19a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe

    TTPs

    Registry Run Keys / Startup FolderModify Registry

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce19a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\llibnmakwdf = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\crsyvf.exe\""19a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
  • Enumerates connected drives
    19a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe

    Description

    Attempts to read the root path of hard drives other than the default C: drive.

    TTPs

    Query RegistryPeripheral Device DiscoverySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    File opened (read-only)\??\J:19a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    File opened (read-only)\??\L:19a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    File opened (read-only)\??\A:19a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    File opened (read-only)\??\H:19a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    File opened (read-only)\??\I:19a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    File opened (read-only)\??\M:19a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    File opened (read-only)\??\O:19a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    File opened (read-only)\??\U:19a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    File opened (read-only)\??\W:19a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    File opened (read-only)\??\X:19a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    File opened (read-only)\??\E:19a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    File opened (read-only)\??\F:19a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    File opened (read-only)\??\G:19a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    File opened (read-only)\??\Y:19a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    File opened (read-only)\??\Z:19a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    File opened (read-only)\??\R:19a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    File opened (read-only)\??\B:19a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    File opened (read-only)\??\P:19a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    File opened (read-only)\??\Q:19a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    File opened (read-only)\??\T:19a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    File opened (read-only)\??\V:19a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    File opened (read-only)\??\K:19a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    File opened (read-only)\??\N:19a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    File opened (read-only)\??\S:19a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
  • Checks processor information in registry
    19a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe

    Description

    Processor information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\019a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString19a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier19a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
  • Suspicious behavior: EnumeratesProcesses
    19a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe

    Reported IOCs

    pidprocess
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
  • Suspicious use of SetWindowsHookAW
    19a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe

    Reported IOCs

    pidprocess
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
  • Suspicious use of WriteProcessMemory
    19a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1048 wrote to memory of 560104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 560104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 560104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 560104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 832104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 832104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 832104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 832104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 1516104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 1516104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 1516104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 1516104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 1636104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 1636104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 1636104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 1636104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 772104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 772104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 772104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 772104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 612104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 612104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 612104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 612104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 276104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 276104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 276104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 276104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 1052104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 1052104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 1052104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 1052104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 1784104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 1784104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 1784104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 1784104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 1520104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 1520104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 1520104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 1520104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 1724104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 1724104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 1724104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 1724104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 972104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 972104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 972104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 972104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 1868104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 1868104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 1868104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 1868104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 892104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 892104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 892104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 892104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 1764104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 1764104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 1764104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 1764104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 2036104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 2036104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 2036104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
    PID 1048 wrote to memory of 2036104819a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exenslookup.exe
Processes 104
  • C:\Users\Admin\AppData\Local\Temp\19a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe
    "C:\Users\Admin\AppData\Local\Temp\19a20164cbd7f6c532d7a6a3886cf0b60ecad0dba6d2d2fe60123c9f6ad2c89c.exe"
    Adds Run key to start application
    Enumerates connected drives
    Checks processor information in registry
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of SetWindowsHookAW
    Suspicious use of WriteProcessMemory
    PID:1048
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      PID:560
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      PID:832
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      PID:1516
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.corp-servers.ru
      PID:1636
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      PID:772
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      PID:612
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      PID:276
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.corp-servers.ru
      PID:1052
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      PID:1784
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      PID:1520
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      PID:1724
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.corp-servers.ru
      PID:972
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      PID:1868
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      PID:892
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      PID:1764
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.corp-servers.ru
      PID:2036
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      PID:608
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      PID:1984
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      PID:1712
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.corp-servers.ru
      PID:1704
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      PID:1296
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      PID:592
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      PID:1760
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.corp-servers.ru
      PID:112
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      PID:2024
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      PID:1260
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      PID:1624
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.corp-servers.ru
      PID:1384
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      PID:1264
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      PID:572
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      PID:684
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.corp-servers.ru
      PID:912
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      PID:976
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      PID:1560
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      PID:1368
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.corp-servers.ru
      PID:540
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      PID:1428
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      PID:1904
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      PID:1584
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.corp-servers.ru
      PID:288
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      PID:964
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      PID:2032
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      PID:1364
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.corp-servers.ru
      PID:1596
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      PID:1620
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      PID:1016
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      PID:1556
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.corp-servers.ru
      PID:456
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      PID:804
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      PID:796
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      PID:1552
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.corp-servers.ru
      PID:1544
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      PID:1528
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      PID:1796
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      PID:1880
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.corp-servers.ru
      PID:960
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      PID:1500
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      PID:1576
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      PID:1732
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.corp-servers.ru
      PID:1672
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      PID:1820
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      PID:1928
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      PID:1668
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.corp-servers.ru
      PID:1600
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      PID:836
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      PID:1316
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      PID:1132
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.corp-servers.ru
      PID:1120
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      PID:768
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      PID:1072
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      PID:268
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.corp-servers.ru
      PID:1816
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      PID:1336
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      PID:1640
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      PID:1164
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.corp-servers.ru
      PID:1912
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      PID:1608
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      PID:1664
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      PID:1068
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.corp-servers.ru
      PID:1148
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      PID:1688
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      PID:1988
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      PID:1280
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.corp-servers.ru
      PID:1380
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      PID:1232
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      PID:1572
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      PID:984
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.corp-servers.ru
      PID:1272
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      PID:956
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      PID:1064
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      PID:340
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.corp-servers.ru
      PID:1036
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      PID:1312
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      PID:756
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      PID:272
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.corp-servers.ru
      PID:1828
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      PID:548
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      PID:1392
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      PID:1480
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.corp-servers.ru
      PID:472
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns1.corp-servers.ru
      PID:844
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.corp-servers.ru
      PID:672
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup zonealarm.bit ns2.corp-servers.ru
      PID:1616
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Privilege Escalation
                    Replay Monitor
                    00:00 00:00
                    Downloads
                    • memory/112-86-0x0000000000000000-mapping.dmp

                    • memory/276-69-0x0000000000000000-mapping.dmp

                    • memory/288-102-0x0000000000000000-mapping.dmp

                    • memory/456-110-0x0000000000000000-mapping.dmp

                    • memory/540-98-0x0000000000000000-mapping.dmp

                    • memory/560-63-0x0000000000000000-mapping.dmp

                    • memory/572-92-0x0000000000000000-mapping.dmp

                    • memory/592-84-0x0000000000000000-mapping.dmp

                    • memory/608-79-0x0000000000000000-mapping.dmp

                    • memory/612-68-0x0000000000000000-mapping.dmp

                    • memory/684-93-0x0000000000000000-mapping.dmp

                    • memory/772-67-0x0000000000000000-mapping.dmp

                    • memory/796-112-0x0000000000000000-mapping.dmp

                    • memory/804-111-0x0000000000000000-mapping.dmp

                    • memory/832-64-0x0000000000000000-mapping.dmp

                    • memory/892-76-0x0000000000000000-mapping.dmp

                    • memory/912-94-0x0000000000000000-mapping.dmp

                    • memory/960-118-0x0000000000000000-mapping.dmp

                    • memory/964-103-0x0000000000000000-mapping.dmp

                    • memory/972-74-0x0000000000000000-mapping.dmp

                    • memory/976-95-0x0000000000000000-mapping.dmp

                    • memory/1016-108-0x0000000000000000-mapping.dmp

                    • memory/1048-62-0x0000000000510000-0x0000000000527000-memory.dmp

                    • memory/1048-61-0x0000000000400000-0x0000000000433000-memory.dmp

                    • memory/1048-60-0x0000000075721000-0x0000000075723000-memory.dmp

                    • memory/1052-70-0x0000000000000000-mapping.dmp

                    • memory/1260-88-0x0000000000000000-mapping.dmp

                    • memory/1264-91-0x0000000000000000-mapping.dmp

                    • memory/1296-83-0x0000000000000000-mapping.dmp

                    • memory/1364-105-0x0000000000000000-mapping.dmp

                    • memory/1368-97-0x0000000000000000-mapping.dmp

                    • memory/1384-90-0x0000000000000000-mapping.dmp

                    • memory/1428-99-0x0000000000000000-mapping.dmp

                    • memory/1500-119-0x0000000000000000-mapping.dmp

                    • memory/1516-65-0x0000000000000000-mapping.dmp

                    • memory/1520-72-0x0000000000000000-mapping.dmp

                    • memory/1528-115-0x0000000000000000-mapping.dmp

                    • memory/1544-114-0x0000000000000000-mapping.dmp

                    • memory/1552-113-0x0000000000000000-mapping.dmp

                    • memory/1556-109-0x0000000000000000-mapping.dmp

                    • memory/1560-96-0x0000000000000000-mapping.dmp

                    • memory/1576-120-0x0000000000000000-mapping.dmp

                    • memory/1584-101-0x0000000000000000-mapping.dmp

                    • memory/1596-106-0x0000000000000000-mapping.dmp

                    • memory/1600-126-0x0000000000000000-mapping.dmp

                    • memory/1620-107-0x0000000000000000-mapping.dmp

                    • memory/1624-89-0x0000000000000000-mapping.dmp

                    • memory/1636-66-0x0000000000000000-mapping.dmp

                    • memory/1668-125-0x0000000000000000-mapping.dmp

                    • memory/1672-122-0x0000000000000000-mapping.dmp

                    • memory/1704-82-0x0000000000000000-mapping.dmp

                    • memory/1712-81-0x0000000000000000-mapping.dmp

                    • memory/1724-73-0x0000000000000000-mapping.dmp

                    • memory/1732-121-0x0000000000000000-mapping.dmp

                    • memory/1760-85-0x0000000000000000-mapping.dmp

                    • memory/1764-77-0x0000000000000000-mapping.dmp

                    • memory/1784-71-0x0000000000000000-mapping.dmp

                    • memory/1796-116-0x0000000000000000-mapping.dmp

                    • memory/1820-123-0x0000000000000000-mapping.dmp

                    • memory/1868-75-0x0000000000000000-mapping.dmp

                    • memory/1880-117-0x0000000000000000-mapping.dmp

                    • memory/1904-100-0x0000000000000000-mapping.dmp

                    • memory/1928-124-0x0000000000000000-mapping.dmp

                    • memory/1984-80-0x0000000000000000-mapping.dmp

                    • memory/2024-87-0x0000000000000000-mapping.dmp

                    • memory/2032-104-0x0000000000000000-mapping.dmp

                    • memory/2036-78-0x0000000000000000-mapping.dmp