gandcrab | a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127

General

Target

a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe
Size

276KB
MD5

15b4612ff391269e3c0ca6067323b55d
SHA1

407f70be2d780f6792b4de8826c0548d075aada9
SHA256

a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127
SHA512

36e7aa5c1638eaaedcace5d1e58300c8f3031f0cb11c2c538e340760d83926ceffe6afbc24e24c36ef4eaf66892cdd95180d43e70d4f377015b51c2d9cb36b84

Score

10^/10

gandcrab backdoor persistence ransomware

Malware Config

Signatures

GandCrab Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1676-61-0x0000000000220000-0x0000000000237000-memory.dmp	family_gandcrab

Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\hcemofoozyd = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\lyeqwx.exe\""	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe

description	ioc	process
File opened (read-only)	\??\B:	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe
File opened (read-only)	\??\I:	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe
File opened (read-only)	\??\K:	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe
File opened (read-only)	\??\Q:	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe
File opened (read-only)	\??\S:	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe
File opened (read-only)	\??\U:	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe
File opened (read-only)	\??\A:	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe
File opened (read-only)	\??\H:	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe
File opened (read-only)	\??\V:	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe
File opened (read-only)	\??\Z:	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe
File opened (read-only)	\??\E:	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe
File opened (read-only)	\??\J:	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe
File opened (read-only)	\??\M:	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe
File opened (read-only)	\??\N:	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe
File opened (read-only)	\??\P:	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe
File opened (read-only)	\??\F:	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe
File opened (read-only)	\??\G:	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe
File opened (read-only)	\??\L:	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe
File opened (read-only)	\??\O:	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe
File opened (read-only)	\??\R:	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe
File opened (read-only)	\??\T:	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe
File opened (read-only)	\??\W:	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe
File opened (read-only)	\??\X:	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe
File opened (read-only)	\??\Y:	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe

pid	process
1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe
1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe

description	pid	process	target process
PID 1676 wrote to memory of 972	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 972	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 972	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 972	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 672	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 672	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 672	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 672	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 948	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 948	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 948	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 948	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 472	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 472	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 472	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 472	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 1536	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 1536	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 1536	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 1536	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 1388	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 1388	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 1388	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 1388	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 616	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 616	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 616	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 616	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 1568	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 1568	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 1568	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 1568	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 1700	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 1700	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 1700	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 1700	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 540	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 540	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 540	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 540	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 1140	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 1140	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 1140	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 1140	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 856	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 856	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 856	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 856	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 1612	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 1612	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 1612	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 1612	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 1664	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 1664	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 1664	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 1664	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 1492	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 1492	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 1492	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 1492	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 1032	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 1032	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 1032	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe
PID 1676 wrote to memory of 1032	1676	a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe	nslookup.exe

C:\Users\Admin\AppData\Local\Temp\a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe
"C:\Users\Admin\AppData\Local\Temp\a56b6f33d1d25ea6e179f69c6f65d7cbf344a2554f5398c713914fca3d183127.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:972

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:672

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:948

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:472

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1536

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1388

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:616

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1568

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1700

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:540

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1140

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:856

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1612

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1664

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1492

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1032

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:660

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1672

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1688

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1036

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1556

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:436

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:836

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:516

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1796

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:240

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1600

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1888

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1328

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1752

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:904

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1892

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:876

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1812

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1616

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:968

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:524

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1384

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1872

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1284

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1152

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1940

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:908

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1996

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:576

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:568

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:812

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1660

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1592

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1272

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1048

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1584

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1368

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1456

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1476

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1732

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:828

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:624

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1704

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:824

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1548

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1296

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1544

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:304

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1136

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1360

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:368

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1132

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1512

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1880

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1064

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1340

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:736

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1840

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:740

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1632

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1564

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:556

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1864

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:564

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:864

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1736

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:932

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1976

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:944

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1416

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1348

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1956

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1468

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:748

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:964

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1096

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1344

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:792

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:764

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1508

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1020

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1628

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1876

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1588

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:596

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:732

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1640

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1308

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1944

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1480

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1316

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1376

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1292

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:112

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:2024

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/240-87-0x0000000000000000-mapping.dmp

Download
memory/304-125-0x0000000000000000-mapping.dmp

Download
memory/436-83-0x0000000000000000-mapping.dmp

Download
memory/472-65-0x0000000000000000-mapping.dmp

Download
memory/516-85-0x0000000000000000-mapping.dmp

Download
memory/524-98-0x0000000000000000-mapping.dmp

Download
memory/540-71-0x0000000000000000-mapping.dmp

Download
memory/568-107-0x0000000000000000-mapping.dmp

Download
memory/576-106-0x0000000000000000-mapping.dmp

Download
memory/616-68-0x0000000000000000-mapping.dmp

Download
memory/624-119-0x0000000000000000-mapping.dmp

Download
memory/660-78-0x0000000000000000-mapping.dmp

Download
memory/672-63-0x0000000000000000-mapping.dmp

Download
memory/812-108-0x0000000000000000-mapping.dmp

Download
memory/824-121-0x0000000000000000-mapping.dmp

Download
memory/828-118-0x0000000000000000-mapping.dmp

Download
memory/836-84-0x0000000000000000-mapping.dmp

Download
memory/856-73-0x0000000000000000-mapping.dmp

Download
memory/876-94-0x0000000000000000-mapping.dmp

Download
memory/904-92-0x0000000000000000-mapping.dmp

Download
memory/908-104-0x0000000000000000-mapping.dmp

Download
memory/948-64-0x0000000000000000-mapping.dmp

Download
memory/968-97-0x0000000000000000-mapping.dmp

Download
memory/972-62-0x0000000000000000-mapping.dmp

Download
memory/1032-77-0x0000000000000000-mapping.dmp

Download
memory/1036-81-0x0000000000000000-mapping.dmp

Download
memory/1048-112-0x0000000000000000-mapping.dmp

Download
memory/1140-72-0x0000000000000000-mapping.dmp

Download
memory/1152-102-0x0000000000000000-mapping.dmp

Download
memory/1272-111-0x0000000000000000-mapping.dmp

Download
memory/1284-101-0x0000000000000000-mapping.dmp

Download
memory/1296-123-0x0000000000000000-mapping.dmp

Download
memory/1328-90-0x0000000000000000-mapping.dmp

Download
memory/1368-114-0x0000000000000000-mapping.dmp

Download
memory/1384-99-0x0000000000000000-mapping.dmp

Download
memory/1388-67-0x0000000000000000-mapping.dmp

Download
memory/1456-115-0x0000000000000000-mapping.dmp

Download
memory/1476-116-0x0000000000000000-mapping.dmp

Download
memory/1492-76-0x0000000000000000-mapping.dmp

Download
memory/1536-66-0x0000000000000000-mapping.dmp

Download
memory/1544-124-0x0000000000000000-mapping.dmp

Download
memory/1548-122-0x0000000000000000-mapping.dmp

Download
memory/1556-82-0x0000000000000000-mapping.dmp

Download
memory/1568-69-0x0000000000000000-mapping.dmp

Download
memory/1584-113-0x0000000000000000-mapping.dmp

Download
memory/1592-110-0x0000000000000000-mapping.dmp

Download
memory/1600-88-0x0000000000000000-mapping.dmp

Download
memory/1612-74-0x0000000000000000-mapping.dmp

Download
memory/1616-96-0x0000000000000000-mapping.dmp

Download
memory/1660-109-0x0000000000000000-mapping.dmp

Download
memory/1664-75-0x0000000000000000-mapping.dmp

Download
memory/1672-79-0x0000000000000000-mapping.dmp

Download
memory/1676-59-0x0000000075971000-0x0000000075973000-memory.dmp

Filesize
8KB

Download
memory/1676-61-0x0000000000220000-0x0000000000237000-memory.dmp

Filesize
92KB

Download
memory/1676-60-0x0000000000400000-0x00000000009F7000-memory.dmp

Filesize
6.0MB

Download
memory/1688-80-0x0000000000000000-mapping.dmp

Download
memory/1700-70-0x0000000000000000-mapping.dmp

Download
memory/1704-120-0x0000000000000000-mapping.dmp

Download
memory/1732-117-0x0000000000000000-mapping.dmp

Download
memory/1752-91-0x0000000000000000-mapping.dmp

Download
memory/1796-86-0x0000000000000000-mapping.dmp

Download
memory/1812-95-0x0000000000000000-mapping.dmp

Download
memory/1872-100-0x0000000000000000-mapping.dmp

Download
memory/1888-89-0x0000000000000000-mapping.dmp

Download
memory/1892-93-0x0000000000000000-mapping.dmp

Download
memory/1940-103-0x0000000000000000-mapping.dmp

Download
memory/1996-105-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads