tracking_number.pdf.exe

General
Target

tracking_number.pdf.exe

Filesize

214KB

Completed

27-06-2021 12:08

Score
10/10
MD5

b4fc1596157eb7b7900dd1da72c301c4

SHA1

e0c4095c71475036bd79f8bb926fcb575d446d36

SHA256

0452a7ada10bdeda0eb905da0549955f9ce8486ff7cf76a51d73f90a90e89aad

Malware Config
Signatures 7

Filter: none

Defense Evasion
Discovery
Persistence
  • GandCrab Payload

    Reported IOCs

    resourceyara_rule
    behavioral2/memory/772-116-0x0000000000690000-0x00000000006A7000-memory.dmpfamily_gandcrab
  • Gandcrab

    Description

    Gandcrab is a Trojan horse that encrypts files on a computer.

  • Adds Run key to start application
    tracking_number.pdf.exe

    TTPs

    Registry Run Keys / Startup FolderModify Registry

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOncetracking_number.pdf.exe
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bsjkgkyqlkn = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\rvzeaf.exe\""tracking_number.pdf.exe
  • Enumerates connected drives
    tracking_number.pdf.exe

    Description

    Attempts to read the root path of hard drives other than the default C: drive.

    TTPs

    Query RegistryPeripheral Device DiscoverySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    File opened (read-only)\??\B:tracking_number.pdf.exe
    File opened (read-only)\??\F:tracking_number.pdf.exe
    File opened (read-only)\??\T:tracking_number.pdf.exe
    File opened (read-only)\??\W:tracking_number.pdf.exe
    File opened (read-only)\??\Y:tracking_number.pdf.exe
    File opened (read-only)\??\I:tracking_number.pdf.exe
    File opened (read-only)\??\K:tracking_number.pdf.exe
    File opened (read-only)\??\O:tracking_number.pdf.exe
    File opened (read-only)\??\P:tracking_number.pdf.exe
    File opened (read-only)\??\Z:tracking_number.pdf.exe
    File opened (read-only)\??\X:tracking_number.pdf.exe
    File opened (read-only)\??\A:tracking_number.pdf.exe
    File opened (read-only)\??\J:tracking_number.pdf.exe
    File opened (read-only)\??\L:tracking_number.pdf.exe
    File opened (read-only)\??\N:tracking_number.pdf.exe
    File opened (read-only)\??\Q:tracking_number.pdf.exe
    File opened (read-only)\??\R:tracking_number.pdf.exe
    File opened (read-only)\??\V:tracking_number.pdf.exe
    File opened (read-only)\??\E:tracking_number.pdf.exe
    File opened (read-only)\??\G:tracking_number.pdf.exe
    File opened (read-only)\??\H:tracking_number.pdf.exe
    File opened (read-only)\??\M:tracking_number.pdf.exe
    File opened (read-only)\??\S:tracking_number.pdf.exe
    File opened (read-only)\??\U:tracking_number.pdf.exe
  • Checks processor information in registry
    tracking_number.pdf.exe

    Description

    Processor information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifiertracking_number.pdf.exe
    Key opened\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0tracking_number.pdf.exe
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameStringtracking_number.pdf.exe
  • Suspicious behavior: EnumeratesProcesses
    tracking_number.pdf.exe

    Reported IOCs

    pidprocess
    772tracking_number.pdf.exe
    772tracking_number.pdf.exe
    772tracking_number.pdf.exe
    772tracking_number.pdf.exe
  • Suspicious use of WriteProcessMemory
    tracking_number.pdf.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 772 wrote to memory of 2880772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 2880772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 2880772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 1336772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 1336772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 1336772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 3412772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 3412772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 3412772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 3076772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 3076772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 3076772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 1192772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 1192772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 1192772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 1124772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 1124772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 1124772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 2440772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 2440772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 2440772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 2876772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 2876772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 2876772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 4008772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 4008772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 4008772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 1672772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 1672772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 1672772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 3636772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 3636772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 3636772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 1724772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 1724772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 1724772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 2068772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 2068772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 2068772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 2320772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 2320772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 2320772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 2744772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 2744772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 2744772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 4016772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 4016772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 4016772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 3944772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 3944772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 3944772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 784772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 784772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 784772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 8772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 8772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 8772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 3504772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 3504772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 3504772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 2612772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 2612772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 2612772tracking_number.pdf.exenslookup.exe
    PID 772 wrote to memory of 2084772tracking_number.pdf.exenslookup.exe
Processes 115
  • C:\Users\Admin\AppData\Local\Temp\tracking_number.pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\tracking_number.pdf.exe"
    Adds Run key to start application
    Enumerates connected drives
    Checks processor information in registry
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of WriteProcessMemory
    PID:772
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      PID:2880
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      PID:1336
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      PID:3412
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      PID:3076
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      PID:1192
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      PID:1124
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      PID:2440
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      PID:2876
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      PID:4008
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      PID:1672
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      PID:3636
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      PID:1724
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      PID:2068
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      PID:2320
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      PID:2744
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      PID:4016
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      PID:3944
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      PID:784
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      PID:8
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      PID:3504
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      PID:2612
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      PID:2084
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      PID:2768
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      PID:3908
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      PID:3996
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      PID:3240
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      PID:1144
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      PID:4060
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      PID:2216
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      PID:3420
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      PID:1348
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      PID:1196
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      PID:3236
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      PID:3620
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      PID:1008
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      PID:2152
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      PID:1960
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      PID:3844
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      PID:3476
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      PID:3256
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      PID:3028
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      PID:2252
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      PID:2324
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      PID:2424
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      PID:3992
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      PID:1576
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      PID:3916
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      PID:3540
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      PID:1040
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      PID:2148
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      PID:2256
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      PID:3400
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      PID:2104
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      PID:3392
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      PID:3300
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      PID:3852
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      PID:1340
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      PID:2972
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      PID:1256
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      PID:3968
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      PID:416
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      PID:2080
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      PID:2648
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      PID:2756
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      PID:4076
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      PID:2224
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      PID:3736
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      PID:3640
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      PID:2956
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      PID:1316
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      PID:3220
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      PID:2432
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      PID:2976
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      PID:3124
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      PID:1360
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      PID:4012
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      PID:2268
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      PID:3732
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      PID:1648
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      PID:2428
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      PID:3864
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      PID:2120
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      PID:3768
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      PID:2712
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      PID:2884
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      PID:4080
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      PID:3096
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      PID:3448
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      PID:3744
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      PID:2632
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      PID:3936
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      PID:788
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      PID:2308
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      PID:3948
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      PID:3132
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      PID:4044
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      PID:1564
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      PID:1332
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      PID:3988
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      PID:1412
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      PID:3820
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      PID:2684
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      PID:3644
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      PID:1216
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      PID:2220
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      PID:2356
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      PID:3388
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      PID:2100
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      PID:1320
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      PID:1280
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      PID:3524
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      PID:1816
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      PID:3632
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      PID:588
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Privilege Escalation
                    Replay Monitor
                    00:00 00:00
                    Downloads
                    • memory/8-135-0x0000000000000000-mapping.dmp

                    • memory/416-177-0x0000000000000000-mapping.dmp

                    • memory/772-116-0x0000000000690000-0x00000000006A7000-memory.dmp

                    • memory/772-114-0x0000000000670000-0x000000000068B000-memory.dmp

                    • memory/772-115-0x0000000000400000-0x000000000043C000-memory.dmp

                    • memory/784-134-0x0000000000000000-mapping.dmp

                    • memory/1008-151-0x0000000000000000-mapping.dmp

                    • memory/1040-165-0x0000000000000000-mapping.dmp

                    • memory/1124-122-0x0000000000000000-mapping.dmp

                    • memory/1144-143-0x0000000000000000-mapping.dmp

                    • memory/1192-121-0x0000000000000000-mapping.dmp

                    • memory/1196-148-0x0000000000000000-mapping.dmp

                    • memory/1256-175-0x0000000000000000-mapping.dmp

                    • memory/1336-118-0x0000000000000000-mapping.dmp

                    • memory/1340-173-0x0000000000000000-mapping.dmp

                    • memory/1348-147-0x0000000000000000-mapping.dmp

                    • memory/1576-162-0x0000000000000000-mapping.dmp

                    • memory/1672-126-0x0000000000000000-mapping.dmp

                    • memory/1724-128-0x0000000000000000-mapping.dmp

                    • memory/1960-153-0x0000000000000000-mapping.dmp

                    • memory/2068-129-0x0000000000000000-mapping.dmp

                    • memory/2080-178-0x0000000000000000-mapping.dmp

                    • memory/2084-138-0x0000000000000000-mapping.dmp

                    • memory/2104-169-0x0000000000000000-mapping.dmp

                    • memory/2148-166-0x0000000000000000-mapping.dmp

                    • memory/2152-152-0x0000000000000000-mapping.dmp

                    • memory/2216-145-0x0000000000000000-mapping.dmp

                    • memory/2252-158-0x0000000000000000-mapping.dmp

                    • memory/2256-167-0x0000000000000000-mapping.dmp

                    • memory/2320-130-0x0000000000000000-mapping.dmp

                    • memory/2324-159-0x0000000000000000-mapping.dmp

                    • memory/2424-160-0x0000000000000000-mapping.dmp

                    • memory/2440-123-0x0000000000000000-mapping.dmp

                    • memory/2612-137-0x0000000000000000-mapping.dmp

                    • memory/2648-179-0x0000000000000000-mapping.dmp

                    • memory/2744-131-0x0000000000000000-mapping.dmp

                    • memory/2756-180-0x0000000000000000-mapping.dmp

                    • memory/2768-139-0x0000000000000000-mapping.dmp

                    • memory/2876-124-0x0000000000000000-mapping.dmp

                    • memory/2880-117-0x0000000000000000-mapping.dmp

                    • memory/2972-174-0x0000000000000000-mapping.dmp

                    • memory/3028-157-0x0000000000000000-mapping.dmp

                    • memory/3076-120-0x0000000000000000-mapping.dmp

                    • memory/3236-149-0x0000000000000000-mapping.dmp

                    • memory/3240-142-0x0000000000000000-mapping.dmp

                    • memory/3256-156-0x0000000000000000-mapping.dmp

                    • memory/3300-171-0x0000000000000000-mapping.dmp

                    • memory/3392-170-0x0000000000000000-mapping.dmp

                    • memory/3400-168-0x0000000000000000-mapping.dmp

                    • memory/3412-119-0x0000000000000000-mapping.dmp

                    • memory/3420-146-0x0000000000000000-mapping.dmp

                    • memory/3476-155-0x0000000000000000-mapping.dmp

                    • memory/3504-136-0x0000000000000000-mapping.dmp

                    • memory/3540-164-0x0000000000000000-mapping.dmp

                    • memory/3620-150-0x0000000000000000-mapping.dmp

                    • memory/3636-127-0x0000000000000000-mapping.dmp

                    • memory/3844-154-0x0000000000000000-mapping.dmp

                    • memory/3852-172-0x0000000000000000-mapping.dmp

                    • memory/3908-140-0x0000000000000000-mapping.dmp

                    • memory/3916-163-0x0000000000000000-mapping.dmp

                    • memory/3944-133-0x0000000000000000-mapping.dmp

                    • memory/3968-176-0x0000000000000000-mapping.dmp

                    • memory/3992-161-0x0000000000000000-mapping.dmp

                    • memory/3996-141-0x0000000000000000-mapping.dmp

                    • memory/4008-125-0x0000000000000000-mapping.dmp

                    • memory/4016-132-0x0000000000000000-mapping.dmp

                    • memory/4060-144-0x0000000000000000-mapping.dmp