05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81

General

Target

05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
Size

244KB
MD5

05cef1b91ececba2ec064149a78a7701
SHA1

c08257d3b56da3fef2efd337190a9f1f57e0706c
SHA256

05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81
SHA512

930fb263e6f5feda791217601f3100bf0729aed9351ad218a2edda68fb74e9e489684e7bacd3995c4e016affed1690c53eb62e996bd98ade211ee807bef0667d

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\msqisojcrkt = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\xmeovp.exe\""	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe

description	ioc	process
File opened (read-only)	\??\H:	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
File opened (read-only)	\??\K:	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
File opened (read-only)	\??\M:	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
File opened (read-only)	\??\Q:	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
File opened (read-only)	\??\R:	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
File opened (read-only)	\??\S:	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
File opened (read-only)	\??\W:	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
File opened (read-only)	\??\F:	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
File opened (read-only)	\??\J:	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
File opened (read-only)	\??\L:	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
File opened (read-only)	\??\N:	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
File opened (read-only)	\??\P:	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
File opened (read-only)	\??\V:	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
File opened (read-only)	\??\Z:	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
File opened (read-only)	\??\B:	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
File opened (read-only)	\??\O:	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
File opened (read-only)	\??\T:	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
File opened (read-only)	\??\X:	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
File opened (read-only)	\??\A:	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
File opened (read-only)	\??\E:	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
File opened (read-only)	\??\G:	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
File opened (read-only)	\??\I:	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
File opened (read-only)	\??\U:	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
File opened (read-only)	\??\Y:	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe

Drops file in Windows directory 1 IoCs

Processes:

05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe

description ioc process

File opened for modification C:\Windows\win.ini 05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe

description	ioc	process
File opened for modification	C:\Windows\win.ini	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\UpperFilters	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\LowerFilters	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\UpperFilters	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\LowerFilters	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe

pid	process
3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

Processes:

05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe

description	pid	process
Token: SeLoadDriverPrivilege	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
Token: SeLoadDriverPrivilege	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
Token: SeLoadDriverPrivilege	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
Token: SeLoadDriverPrivilege	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
Token: SeLoadDriverPrivilege	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
Token: SeLoadDriverPrivilege	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
Token: SeLoadDriverPrivilege	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
Token: SeLoadDriverPrivilege	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
Token: SeLoadDriverPrivilege	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
Token: SeLoadDriverPrivilege	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
Token: SeLoadDriverPrivilege	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
Token: SeLoadDriverPrivilege	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
Token: SeLoadDriverPrivilege	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
Token: SeLoadDriverPrivilege	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
Token: SeLoadDriverPrivilege	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
Token: SeLoadDriverPrivilege	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
Token: SeLoadDriverPrivilege	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
Token: SeLoadDriverPrivilege	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
Token: SeLoadDriverPrivilege	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
Token: SeLoadDriverPrivilege	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
Token: SeLoadDriverPrivilege	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
Token: SeLoadDriverPrivilege	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
Token: SeLoadDriverPrivilege	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
Token: SeLoadDriverPrivilege	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
Token: SeLoadDriverPrivilege	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
Token: SeLoadDriverPrivilege	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
Token: SeLoadDriverPrivilege	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
Token: SeLoadDriverPrivilege	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
Token: SeLoadDriverPrivilege	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
Token: SeLoadDriverPrivilege	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe

description	pid	process	target process
PID 3184 wrote to memory of 196	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 196	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 196	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 744	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 744	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 744	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 8	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 8	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 8	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 3260	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 3260	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 3260	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 3848	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 3848	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 3848	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 1748	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 1748	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 1748	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 3160	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 3160	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 3160	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 1348	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 1348	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 1348	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 3392	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 3392	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 3392	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 2792	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 2792	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 2792	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 3864	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 3864	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 3864	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 612	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 612	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 612	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 2732	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 2732	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 2732	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 3692	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 3692	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 3692	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 984	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 984	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 984	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 3680	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 3680	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 3680	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 2868	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 2868	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 2868	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 1380	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 1380	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 1380	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 2116	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 2116	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 2116	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 1852	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 1852	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 1852	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 3724	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 3724	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 3724	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe
PID 3184 wrote to memory of 3832	3184	05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe	nslookup.exe

C:\Users\Admin\AppData\Local\Temp\05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe
"C:\Users\Admin\AppData\Local\Temp\05cb3870434b9e4dbe3154c7131530526f7e935df69a02b4ee023af88b695a81.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3184

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:196

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:744

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:8

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:3260

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:3848

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:1748

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:3160

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:1348

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:3392

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:2792

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:3864

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:612

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:2732

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:3692

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:984

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:3680

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:2868

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:1380

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:2116

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:1852

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:3724

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:3832

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:2208

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:2300

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:3788

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:2948

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:2160

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:3464

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:188

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:2920

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:636

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:764

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:1344

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:3100

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:2788

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:3448

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:2136

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:3932

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:3092

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:192

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:3292

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:3980

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:2272

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:2976

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:420

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:3300

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:3984

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:2296

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:3844

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:1364

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:352

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:500

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:2188

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:2132

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:3152

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:3540

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:3700

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:2256

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:4084

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:1052

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:956

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:1516

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:3296

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:2140

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:2760

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:2848

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:3944

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:684

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:1640

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:936

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:2236

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:3224

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:2328

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:2656

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:1736

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:2284

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:1788

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:2060

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:1168

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:2484

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:372

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:2232

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:1524

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:1360

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:644

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:3768

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:1108

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:3012

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:3884

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:3820

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:400

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:2764

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:3220

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:2240

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:1208

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:800

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:3028

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:2016

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:3636

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:1164

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:2408

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:512

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:1424

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:1060

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:2276

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:2864

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:1732

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:3856

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:3552

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:732

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:3732

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:2112

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:1972

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:2960

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:804

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:2476

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:2268

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:1240

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

3

T1012

Peripheral Device Discovery

2

T1120

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/8-118-0x0000000000000000-mapping.dmp

Download
memory/188-144-0x0000000000000000-mapping.dmp

Download
memory/192-155-0x0000000000000000-mapping.dmp

Download
memory/196-116-0x0000000000000000-mapping.dmp

Download
memory/352-166-0x0000000000000000-mapping.dmp

Download
memory/420-160-0x0000000000000000-mapping.dmp

Download
memory/500-167-0x0000000000000000-mapping.dmp

Download
memory/612-127-0x0000000000000000-mapping.dmp

Download
memory/636-146-0x0000000000000000-mapping.dmp

Download
memory/744-117-0x0000000000000000-mapping.dmp

Download
memory/764-147-0x0000000000000000-mapping.dmp

Download
memory/956-176-0x0000000000000000-mapping.dmp

Download
memory/984-130-0x0000000000000000-mapping.dmp

Download
memory/1052-175-0x0000000000000000-mapping.dmp

Download
memory/1344-148-0x0000000000000000-mapping.dmp

Download
memory/1348-123-0x0000000000000000-mapping.dmp

Download
memory/1364-165-0x0000000000000000-mapping.dmp

Download
memory/1380-133-0x0000000000000000-mapping.dmp

Download
memory/1516-177-0x0000000000000000-mapping.dmp

Download
memory/1748-121-0x0000000000000000-mapping.dmp

Download
memory/1852-135-0x0000000000000000-mapping.dmp

Download
memory/2116-134-0x0000000000000000-mapping.dmp

Download
memory/2132-169-0x0000000000000000-mapping.dmp

Download
memory/2136-152-0x0000000000000000-mapping.dmp

Download
memory/2140-179-0x0000000000000000-mapping.dmp

Download
memory/2160-142-0x0000000000000000-mapping.dmp

Download
memory/2188-168-0x0000000000000000-mapping.dmp

Download
memory/2208-138-0x0000000000000000-mapping.dmp

Download
memory/2256-173-0x0000000000000000-mapping.dmp

Download
memory/2272-158-0x0000000000000000-mapping.dmp

Download
memory/2296-163-0x0000000000000000-mapping.dmp

Download
memory/2300-139-0x0000000000000000-mapping.dmp

Download
memory/2732-128-0x0000000000000000-mapping.dmp

Download
memory/2788-150-0x0000000000000000-mapping.dmp

Download
memory/2792-125-0x0000000000000000-mapping.dmp

Download
memory/2868-132-0x0000000000000000-mapping.dmp

Download
memory/2920-145-0x0000000000000000-mapping.dmp

Download
memory/2948-141-0x0000000000000000-mapping.dmp

Download
memory/2976-159-0x0000000000000000-mapping.dmp

Download
memory/3092-154-0x0000000000000000-mapping.dmp

Download
memory/3100-149-0x0000000000000000-mapping.dmp

Download
memory/3152-170-0x0000000000000000-mapping.dmp

Download
memory/3160-122-0x0000000000000000-mapping.dmp

Download
memory/3184-115-0x0000000000B50000-0x0000000000C9A000-memory.dmp

Filesize
1.3MB

Download
memory/3184-114-0x0000000000400000-0x0000000000B4B000-memory.dmp

Filesize
7.3MB

Download
memory/3260-119-0x0000000000000000-mapping.dmp

Download
memory/3292-156-0x0000000000000000-mapping.dmp

Download
memory/3296-178-0x0000000000000000-mapping.dmp

Download
memory/3300-161-0x0000000000000000-mapping.dmp

Download
memory/3392-124-0x0000000000000000-mapping.dmp

Download
memory/3448-151-0x0000000000000000-mapping.dmp

Download
memory/3464-143-0x0000000000000000-mapping.dmp

Download
memory/3540-171-0x0000000000000000-mapping.dmp

Download
memory/3680-131-0x0000000000000000-mapping.dmp

Download
memory/3692-129-0x0000000000000000-mapping.dmp

Download
memory/3700-172-0x0000000000000000-mapping.dmp

Download
memory/3724-136-0x0000000000000000-mapping.dmp

Download
memory/3788-140-0x0000000000000000-mapping.dmp

Download
memory/3832-137-0x0000000000000000-mapping.dmp

Download
memory/3844-164-0x0000000000000000-mapping.dmp

Download
memory/3848-120-0x0000000000000000-mapping.dmp

Download
memory/3864-126-0x0000000000000000-mapping.dmp

Download
memory/3932-153-0x0000000000000000-mapping.dmp

Download
memory/3980-157-0x0000000000000000-mapping.dmp

Download
memory/3984-162-0x0000000000000000-mapping.dmp

Download
memory/4084-174-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads