gandcrab | 39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa

General

Target

39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe
Size

274KB
MD5

9ae228d810db0b94f3d24d2e40efcdd9
SHA1

72d9096e3fce5d5e8640812ea55917fc3b3cdac7
SHA256

39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa
SHA512

0f251e9f4815b73eb2a183a481bf5c0f40e0a5d4536351c419d474108cf01bb8295b9f0ba5ee0d4d8f65d4c642c9bcb6ec44f1416fe4a3ba545304fecd614c38

Score

10^/10

gandcrab backdoor persistence ransomware

Malware Config

Signatures

GandCrab Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2020-62-0x0000000000220000-0x0000000000237000-memory.dmp	family_gandcrab

Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\yxhrtouknji = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\xznlgl.exe\""	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe

description	ioc	process
File opened (read-only)	\??\Y:	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe
File opened (read-only)	\??\B:	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe
File opened (read-only)	\??\G:	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe
File opened (read-only)	\??\H:	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe
File opened (read-only)	\??\M:	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe
File opened (read-only)	\??\N:	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe
File opened (read-only)	\??\Q:	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe
File opened (read-only)	\??\S:	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe
File opened (read-only)	\??\T:	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe
File opened (read-only)	\??\E:	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe
File opened (read-only)	\??\F:	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe
File opened (read-only)	\??\I:	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe
File opened (read-only)	\??\W:	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe
File opened (read-only)	\??\R:	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe
File opened (read-only)	\??\U:	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe
File opened (read-only)	\??\Z:	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe
File opened (read-only)	\??\J:	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe
File opened (read-only)	\??\L:	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe
File opened (read-only)	\??\P:	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe
File opened (read-only)	\??\V:	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe
File opened (read-only)	\??\X:	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe
File opened (read-only)	\??\A:	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe
File opened (read-only)	\??\K:	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe
File opened (read-only)	\??\O:	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe

pid	process
2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe
2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe

description	pid	process	target process
PID 2020 wrote to memory of 968	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 968	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 968	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 968	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 772	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 772	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 772	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 772	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 1052	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 1052	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 1052	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 1052	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 764	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 764	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 764	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 764	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 1400	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 1400	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 1400	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 1400	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 1644	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 1644	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 1644	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 1644	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 1892	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 1892	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 1892	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 1892	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 1884	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 1884	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 1884	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 1884	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 1712	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 1712	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 1712	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 1712	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 820	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 820	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 820	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 820	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 864	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 864	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 864	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 864	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 1172	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 1172	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 1172	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 1172	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 936	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 936	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 936	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 936	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 604	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 604	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 604	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 604	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 1124	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 1124	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 1124	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 1124	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 1784	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 1784	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 1784	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe
PID 2020 wrote to memory of 1784	2020	39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe	nslookup.exe

C:\Users\Admin\AppData\Local\Temp\39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe
"C:\Users\Admin\AppData\Local\Temp\39e7d5c773cc54ade20c6817b4c0e44466c3b9722c96a1437b3c6bc34b520caa.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:968

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:772

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1052

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:764

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1400

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1644

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1892

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1884

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1712

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:820

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:864

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1172

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:936

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:604

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1124

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1784

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1240

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1780

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1716

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1616

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:952

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1512

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:564

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:280

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:688

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1608

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1580

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1628

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1504

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:948

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1084

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:544

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:800

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:660

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1564

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:2016

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:2040

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1360

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:908

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1668

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:320

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1540

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1404

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1900

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1328

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1260

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1516

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1068

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1760

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1340

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1756

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:976

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:916

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:972

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1904

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1796

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1496

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1544

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:616

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:108

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1652

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1684

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:640

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:932

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1740

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1392

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1264

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1352

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:740

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1692

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1156

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1960

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:924

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1552

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1096

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1388

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:2004

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1440

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1528

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1560

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1768

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1140

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1816

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1592

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1908

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1588

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:596

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:680

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:440

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1216

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1324

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1332

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:992

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:860

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1572

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1664

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1508

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:624

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:400

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1980

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1188

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:112

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:368

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1080

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1368

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1220

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1864

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1680

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1620

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:524

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1896

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:1092

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:1704

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:2044

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1232

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.corp-servers.ru
2⤵
PID:336

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns1.corp-servers.ru
2⤵
PID:836

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.corp-servers.ru
2⤵
PID:1632

C:\Windows\SysWOW64\nslookup.exe
nslookup zonealarm.bit ns2.corp-servers.ru
2⤵
PID:1308

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/108-122-0x0000000000000000-mapping.dmp

Download
memory/280-86-0x0000000000000000-mapping.dmp

Download
memory/320-103-0x0000000000000000-mapping.dmp

Download
memory/544-94-0x0000000000000000-mapping.dmp

Download
memory/564-85-0x0000000000000000-mapping.dmp

Download
memory/604-76-0x0000000000000000-mapping.dmp

Download
memory/616-121-0x0000000000000000-mapping.dmp

Download
memory/640-125-0x0000000000000000-mapping.dmp

Download
memory/660-96-0x0000000000000000-mapping.dmp

Download
memory/688-87-0x0000000000000000-mapping.dmp

Download
memory/764-66-0x0000000000000000-mapping.dmp

Download
memory/772-64-0x0000000000000000-mapping.dmp

Download
memory/800-95-0x0000000000000000-mapping.dmp

Download
memory/820-72-0x0000000000000000-mapping.dmp

Download
memory/864-73-0x0000000000000000-mapping.dmp

Download
memory/908-101-0x0000000000000000-mapping.dmp

Download
memory/916-115-0x0000000000000000-mapping.dmp

Download
memory/932-126-0x0000000000000000-mapping.dmp

Download
memory/936-75-0x0000000000000000-mapping.dmp

Download
memory/948-92-0x0000000000000000-mapping.dmp

Download
memory/952-83-0x0000000000000000-mapping.dmp

Download
memory/968-63-0x0000000000000000-mapping.dmp

Download
memory/972-116-0x0000000000000000-mapping.dmp

Download
memory/976-114-0x0000000000000000-mapping.dmp

Download
memory/1052-65-0x0000000000000000-mapping.dmp

Download
memory/1068-110-0x0000000000000000-mapping.dmp

Download
memory/1084-93-0x0000000000000000-mapping.dmp

Download
memory/1124-77-0x0000000000000000-mapping.dmp

Download
memory/1172-74-0x0000000000000000-mapping.dmp

Download
memory/1240-79-0x0000000000000000-mapping.dmp

Download
memory/1260-108-0x0000000000000000-mapping.dmp

Download
memory/1328-107-0x0000000000000000-mapping.dmp

Download
memory/1340-112-0x0000000000000000-mapping.dmp

Download
memory/1360-100-0x0000000000000000-mapping.dmp

Download
memory/1400-67-0x0000000000000000-mapping.dmp

Download
memory/1404-105-0x0000000000000000-mapping.dmp

Download
memory/1496-119-0x0000000000000000-mapping.dmp

Download
memory/1504-91-0x0000000000000000-mapping.dmp

Download
memory/1512-84-0x0000000000000000-mapping.dmp

Download
memory/1516-109-0x0000000000000000-mapping.dmp

Download
memory/1540-104-0x0000000000000000-mapping.dmp

Download
memory/1544-120-0x0000000000000000-mapping.dmp

Download
memory/1564-97-0x0000000000000000-mapping.dmp

Download
memory/1580-89-0x0000000000000000-mapping.dmp

Download
memory/1608-88-0x0000000000000000-mapping.dmp

Download
memory/1616-82-0x0000000000000000-mapping.dmp

Download
memory/1628-90-0x0000000000000000-mapping.dmp

Download
memory/1644-68-0x0000000000000000-mapping.dmp

Download
memory/1652-123-0x0000000000000000-mapping.dmp

Download
memory/1668-102-0x0000000000000000-mapping.dmp

Download
memory/1684-124-0x0000000000000000-mapping.dmp

Download
memory/1712-71-0x0000000000000000-mapping.dmp

Download
memory/1716-81-0x0000000000000000-mapping.dmp

Download
memory/1756-113-0x0000000000000000-mapping.dmp

Download
memory/1760-111-0x0000000000000000-mapping.dmp

Download
memory/1780-80-0x0000000000000000-mapping.dmp

Download
memory/1784-78-0x0000000000000000-mapping.dmp

Download
memory/1796-118-0x0000000000000000-mapping.dmp

Download
memory/1884-70-0x0000000000000000-mapping.dmp

Download
memory/1892-69-0x0000000000000000-mapping.dmp

Download
memory/1900-106-0x0000000000000000-mapping.dmp

Download
memory/1904-117-0x0000000000000000-mapping.dmp

Download
memory/2016-98-0x0000000000000000-mapping.dmp

Download
memory/2020-60-0x0000000076281000-0x0000000076283000-memory.dmp

Filesize
8KB

Download
memory/2020-62-0x0000000000220000-0x0000000000237000-memory.dmp

Filesize
92KB

Download
memory/2020-61-0x0000000000400000-0x000000000055C000-memory.dmp

Filesize
1.4MB

Download
memory/2040-99-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads