6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5

General

Target

6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe
Size

69KB
MD5

213519c2edbfff7b8e500bcdb7be485e
SHA1

e18581fc06f00e3d9b9b66535c4e0eb4b3bda7ad
SHA256

6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5
SHA512

6642ad4b9c880ba97c6807e7babe5933ff0bdbb1f7ff1d1ab6373531ed418914de0f513ceac9a85c41df81d52bbfeb8d55c1976c547acb38a7433864bbe47019

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\jaosgxwglgn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe"	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe

description	ioc	process
File opened (read-only)	\??\G:	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe
File opened (read-only)	\??\T:	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe
File opened (read-only)	\??\Y:	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe
File opened (read-only)	\??\N:	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe
File opened (read-only)	\??\Q:	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe
File opened (read-only)	\??\U:	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe
File opened (read-only)	\??\A:	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe
File opened (read-only)	\??\E:	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe
File opened (read-only)	\??\F:	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe
File opened (read-only)	\??\J:	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe
File opened (read-only)	\??\L:	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe
File opened (read-only)	\??\W:	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe
File opened (read-only)	\??\O:	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe
File opened (read-only)	\??\V:	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe
File opened (read-only)	\??\P:	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe
File opened (read-only)	\??\R:	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe
File opened (read-only)	\??\S:	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe
File opened (read-only)	\??\B:	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe
File opened (read-only)	\??\H:	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe
File opened (read-only)	\??\I:	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe
File opened (read-only)	\??\K:	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe
File opened (read-only)	\??\M:	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe
File opened (read-only)	\??\X:	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe
File opened (read-only)	\??\Z:	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe

pid	process
3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe
3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe
3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe
3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe

description	pid	process	target process
PID 3560 wrote to memory of 1964	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 1964	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 1964	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 2816	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 2816	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 2816	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 3220	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 3220	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 3220	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 2160	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 2160	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 2160	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 3864	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 3864	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 3864	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 1452	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 1452	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 1452	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 2808	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 2808	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 2808	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 3352	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 3352	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 3352	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 2164	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 2164	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 2164	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 1104	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 1104	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 1104	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 1224	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 1224	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 1224	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 2052	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 2052	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 2052	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 3508	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 3508	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 3508	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 2336	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 2336	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 2336	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 2096	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 2096	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 2096	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 3544	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 3544	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 3544	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 2080	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 2080	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 2080	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 1432	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 1432	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 1432	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 3920	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 3920	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 3920	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 1692	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 1692	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 1692	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 2148	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 2148	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 2148	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe
PID 3560 wrote to memory of 3768	3560	6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe	nslookup.exe

C:\Users\Admin\AppData\Local\Temp\6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe
"C:\Users\Admin\AppData\Local\Temp\6908a0c2228ab8d227cf9ba19def649dce5d45e796c0a3008ceecf629fc489a5.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3560

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1964

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:2816

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:3220

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:2160

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:3864

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1452

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:2808

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:3352

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:2164

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:1104

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:1224

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:2052

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:3508

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:2336

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:2096

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:3544

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:2080

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1432

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:3920

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1692

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:2148

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:3768

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:4068

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:4092

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:692

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:2384

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:784

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:3184

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:1292

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:2324

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:2088

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:3168

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:3840

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:1520

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:3584

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:592

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:988

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:2180

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1632

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:2992

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:1760

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1676

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:2892

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1864

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:2364

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:1604

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:1928

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1428

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:2580

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1184

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1200

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:3788

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:3164

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:2144

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:3848

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1160

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:3004

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:1444

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:1284

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:208

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1892

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1664

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1588

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:3452

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:1164

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:2572

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:2332

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:2976

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:3896

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:3968

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:1860

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:2224

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:3688

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:828

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:2396

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:3744

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:3748

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:780

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:3444

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:3928

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:3860

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:1368

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:1268

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:2200

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1656

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:3984

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:3400

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:2304

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:3608

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1116

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1472

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1108

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:3964

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:3844

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:2280

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:2272

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:820

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:2764

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1216

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:2128

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:2152

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:3176

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1608

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:948

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:3572

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:3224

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:4012

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1300

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:384

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1532

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1700

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:2788

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:2772

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:4032

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:428

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:2376

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:3692

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:3064

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:1456

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:2032

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:2312

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1124

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1072

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:1844

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:3936

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:3700

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:352

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1060

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/208-173-0x0000000000000000-mapping.dmp

Download
memory/592-149-0x0000000000000000-mapping.dmp

Download
memory/692-138-0x0000000000000000-mapping.dmp

Download
memory/784-140-0x0000000000000000-mapping.dmp

Download
memory/988-150-0x0000000000000000-mapping.dmp

Download
memory/1104-123-0x0000000000000000-mapping.dmp

Download
memory/1160-169-0x0000000000000000-mapping.dmp

Download
memory/1184-163-0x0000000000000000-mapping.dmp

Download
memory/1200-164-0x0000000000000000-mapping.dmp

Download
memory/1224-124-0x0000000000000000-mapping.dmp

Download
memory/1284-172-0x0000000000000000-mapping.dmp

Download
memory/1292-142-0x0000000000000000-mapping.dmp

Download
memory/1428-161-0x0000000000000000-mapping.dmp

Download
memory/1432-131-0x0000000000000000-mapping.dmp

Download
memory/1444-171-0x0000000000000000-mapping.dmp

Download
memory/1452-119-0x0000000000000000-mapping.dmp

Download
memory/1520-147-0x0000000000000000-mapping.dmp

Download
memory/1588-176-0x0000000000000000-mapping.dmp

Download
memory/1604-159-0x0000000000000000-mapping.dmp

Download
memory/1632-152-0x0000000000000000-mapping.dmp

Download
memory/1664-175-0x0000000000000000-mapping.dmp

Download
memory/1676-155-0x0000000000000000-mapping.dmp

Download
memory/1692-133-0x0000000000000000-mapping.dmp

Download
memory/1760-154-0x0000000000000000-mapping.dmp

Download
memory/1864-157-0x0000000000000000-mapping.dmp

Download
memory/1892-174-0x0000000000000000-mapping.dmp

Download
memory/1928-160-0x0000000000000000-mapping.dmp

Download
memory/1964-114-0x0000000000000000-mapping.dmp

Download
memory/2052-125-0x0000000000000000-mapping.dmp

Download
memory/2080-130-0x0000000000000000-mapping.dmp

Download
memory/2088-144-0x0000000000000000-mapping.dmp

Download
memory/2096-128-0x0000000000000000-mapping.dmp

Download
memory/2144-167-0x0000000000000000-mapping.dmp

Download
memory/2148-134-0x0000000000000000-mapping.dmp

Download
memory/2160-117-0x0000000000000000-mapping.dmp

Download
memory/2164-122-0x0000000000000000-mapping.dmp

Download
memory/2180-151-0x0000000000000000-mapping.dmp

Download
memory/2324-143-0x0000000000000000-mapping.dmp

Download
memory/2336-127-0x0000000000000000-mapping.dmp

Download
memory/2364-158-0x0000000000000000-mapping.dmp

Download
memory/2384-139-0x0000000000000000-mapping.dmp

Download
memory/2580-162-0x0000000000000000-mapping.dmp

Download
memory/2808-120-0x0000000000000000-mapping.dmp

Download
memory/2816-115-0x0000000000000000-mapping.dmp

Download
memory/2892-156-0x0000000000000000-mapping.dmp

Download
memory/2992-153-0x0000000000000000-mapping.dmp

Download
memory/3004-170-0x0000000000000000-mapping.dmp

Download
memory/3164-166-0x0000000000000000-mapping.dmp

Download
memory/3168-145-0x0000000000000000-mapping.dmp

Download
memory/3184-141-0x0000000000000000-mapping.dmp

Download
memory/3220-116-0x0000000000000000-mapping.dmp

Download
memory/3352-121-0x0000000000000000-mapping.dmp

Download
memory/3452-177-0x0000000000000000-mapping.dmp

Download
memory/3508-126-0x0000000000000000-mapping.dmp

Download
memory/3544-129-0x0000000000000000-mapping.dmp

Download
memory/3584-148-0x0000000000000000-mapping.dmp

Download
memory/3768-135-0x0000000000000000-mapping.dmp

Download
memory/3788-165-0x0000000000000000-mapping.dmp

Download
memory/3840-146-0x0000000000000000-mapping.dmp

Download
memory/3848-168-0x0000000000000000-mapping.dmp

Download
memory/3864-118-0x0000000000000000-mapping.dmp

Download
memory/3920-132-0x0000000000000000-mapping.dmp

Download
memory/4068-136-0x0000000000000000-mapping.dmp

Download
memory/4092-137-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads