Analysis
-
max time kernel
152s -
max time network
153s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
13-10-2021 15:39
Static task
static1
Behavioral task
behavioral1
Sample
cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe
Resource
win10v20210408
General
-
Target
cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe
-
Size
244KB
-
MD5
cd0de24dd59d160507545851f4c0d917
-
SHA1
a78fca87aace910f8e59dd614664e082249b8a68
-
SHA256
cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08
-
SHA512
130ac29407b1a5903c144684e846a8eabe54d47ed13ebcc676eb1d4b598b52c446c6f5021fdea2035d838e562b6a08e7f0578bfe3379824dbd1b5b9ce374e12d
Malware Config
Signatures
-
GandCrab Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/504-115-0x0000000000400000-0x0000000000B4B000-memory.dmp family_gandcrab behavioral2/memory/504-118-0x00000000001D0000-0x00000000001E7000-memory.dmp family_gandcrab -
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\kjjjvmnddgt = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\xdffnq.exe\"" cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exedescription ioc process File opened (read-only) \??\X: cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe File opened (read-only) \??\F: cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe File opened (read-only) \??\J: cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe File opened (read-only) \??\N: cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe File opened (read-only) \??\O: cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe File opened (read-only) \??\Q: cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe File opened (read-only) \??\W: cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe File opened (read-only) \??\A: cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe File opened (read-only) \??\G: cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe File opened (read-only) \??\H: cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe File opened (read-only) \??\M: cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe File opened (read-only) \??\P: cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe File opened (read-only) \??\Y: cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe File opened (read-only) \??\R: cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe File opened (read-only) \??\S: cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe File opened (read-only) \??\U: cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe File opened (read-only) \??\V: cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe File opened (read-only) \??\B: cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe File opened (read-only) \??\E: cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe File opened (read-only) \??\I: cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe File opened (read-only) \??\K: cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe File opened (read-only) \??\L: cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe File opened (read-only) \??\T: cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe File opened (read-only) \??\Z: cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe -
Drops file in Windows directory 1 IoCs
Processes:
cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exedescription ioc process File opened for modification C:\Windows\win.ini cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe -
Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\UpperFilters cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\LowerFilters cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\UpperFilters cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\LowerFilters cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exepid process 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe -
Suspicious use of AdjustPrivilegeToken 30 IoCs
Processes:
cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exedescription pid process Token: SeLoadDriverPrivilege 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe Token: SeLoadDriverPrivilege 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe Token: SeLoadDriverPrivilege 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe Token: SeLoadDriverPrivilege 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe Token: SeLoadDriverPrivilege 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe Token: SeLoadDriverPrivilege 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe Token: SeLoadDriverPrivilege 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe Token: SeLoadDriverPrivilege 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe Token: SeLoadDriverPrivilege 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe Token: SeLoadDriverPrivilege 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe Token: SeLoadDriverPrivilege 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe Token: SeLoadDriverPrivilege 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe Token: SeLoadDriverPrivilege 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe Token: SeLoadDriverPrivilege 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe Token: SeLoadDriverPrivilege 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe Token: SeLoadDriverPrivilege 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe Token: SeLoadDriverPrivilege 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe Token: SeLoadDriverPrivilege 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe Token: SeLoadDriverPrivilege 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe Token: SeLoadDriverPrivilege 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe Token: SeLoadDriverPrivilege 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe Token: SeLoadDriverPrivilege 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe Token: SeLoadDriverPrivilege 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe Token: SeLoadDriverPrivilege 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe Token: SeLoadDriverPrivilege 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe Token: SeLoadDriverPrivilege 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe Token: SeLoadDriverPrivilege 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe Token: SeLoadDriverPrivilege 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe Token: SeLoadDriverPrivilege 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe Token: SeLoadDriverPrivilege 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exedescription pid process target process PID 504 wrote to memory of 2344 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 2344 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 2344 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 3576 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 3576 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 3576 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 1196 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 1196 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 1196 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 1488 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 1488 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 1488 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 1856 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 1856 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 1856 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 2200 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 2200 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 2200 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 3268 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 3268 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 3268 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 900 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 900 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 900 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 1872 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 1872 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 1872 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 3804 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 3804 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 3804 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 3204 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 3204 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 3204 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 3880 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 3880 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 3880 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 3664 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 3664 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 3664 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 580 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 580 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 580 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 2580 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 2580 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 2580 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 3788 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 3788 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 3788 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 1376 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 1376 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 1376 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 1920 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 1920 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 1920 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 2000 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 2000 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 2000 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 2140 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 2140 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 2140 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 3828 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 3828 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 3828 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe PID 504 wrote to memory of 2888 504 cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe nslookup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe"C:\Users\Admin\AppData\Local\Temp\cc5f8dfc803b35d83f059f019c6d937fa2ce52e79d112f29630e9050aee2de08.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/64-163-0x0000000000000000-mapping.dmp
-
memory/504-115-0x0000000000400000-0x0000000000B4B000-memory.dmpFilesize
7.3MB
-
memory/504-116-0x0000000000400000-0x0000000000B4B000-memory.dmpFilesize
7.3MB
-
memory/504-118-0x00000000001D0000-0x00000000001E7000-memory.dmpFilesize
92KB
-
memory/504-114-0x0000000000D56000-0x0000000000D72000-memory.dmpFilesize
112KB
-
memory/580-132-0x0000000000000000-mapping.dmp
-
memory/584-165-0x0000000000000000-mapping.dmp
-
memory/664-143-0x0000000000000000-mapping.dmp
-
memory/744-158-0x0000000000000000-mapping.dmp
-
memory/876-174-0x0000000000000000-mapping.dmp
-
memory/900-126-0x0000000000000000-mapping.dmp
-
memory/948-146-0x0000000000000000-mapping.dmp
-
memory/1072-176-0x0000000000000000-mapping.dmp
-
memory/1196-121-0x0000000000000000-mapping.dmp
-
memory/1212-147-0x0000000000000000-mapping.dmp
-
memory/1252-181-0x0000000000000000-mapping.dmp
-
memory/1308-157-0x0000000000000000-mapping.dmp
-
memory/1376-135-0x0000000000000000-mapping.dmp
-
memory/1384-151-0x0000000000000000-mapping.dmp
-
memory/1444-172-0x0000000000000000-mapping.dmp
-
memory/1472-161-0x0000000000000000-mapping.dmp
-
memory/1488-122-0x0000000000000000-mapping.dmp
-
memory/1512-175-0x0000000000000000-mapping.dmp
-
memory/1528-166-0x0000000000000000-mapping.dmp
-
memory/1856-123-0x0000000000000000-mapping.dmp
-
memory/1872-127-0x0000000000000000-mapping.dmp
-
memory/1920-136-0x0000000000000000-mapping.dmp
-
memory/1936-152-0x0000000000000000-mapping.dmp
-
memory/1996-173-0x0000000000000000-mapping.dmp
-
memory/2000-137-0x0000000000000000-mapping.dmp
-
memory/2072-179-0x0000000000000000-mapping.dmp
-
memory/2088-148-0x0000000000000000-mapping.dmp
-
memory/2140-138-0x0000000000000000-mapping.dmp
-
memory/2156-149-0x0000000000000000-mapping.dmp
-
memory/2172-162-0x0000000000000000-mapping.dmp
-
memory/2200-124-0x0000000000000000-mapping.dmp
-
memory/2212-167-0x0000000000000000-mapping.dmp
-
memory/2320-159-0x0000000000000000-mapping.dmp
-
memory/2344-119-0x0000000000000000-mapping.dmp
-
memory/2432-155-0x0000000000000000-mapping.dmp
-
memory/2480-156-0x0000000000000000-mapping.dmp
-
memory/2532-180-0x0000000000000000-mapping.dmp
-
memory/2580-133-0x0000000000000000-mapping.dmp
-
memory/2584-169-0x0000000000000000-mapping.dmp
-
memory/2588-144-0x0000000000000000-mapping.dmp
-
memory/2888-140-0x0000000000000000-mapping.dmp
-
memory/2892-171-0x0000000000000000-mapping.dmp
-
memory/2968-150-0x0000000000000000-mapping.dmp
-
memory/3040-141-0x0000000000000000-mapping.dmp
-
memory/3168-142-0x0000000000000000-mapping.dmp
-
memory/3196-177-0x0000000000000000-mapping.dmp
-
memory/3200-153-0x0000000000000000-mapping.dmp
-
memory/3204-129-0x0000000000000000-mapping.dmp
-
memory/3236-178-0x0000000000000000-mapping.dmp
-
memory/3268-125-0x0000000000000000-mapping.dmp
-
memory/3572-168-0x0000000000000000-mapping.dmp
-
memory/3576-120-0x0000000000000000-mapping.dmp
-
memory/3588-182-0x0000000000000000-mapping.dmp
-
memory/3616-164-0x0000000000000000-mapping.dmp
-
memory/3664-131-0x0000000000000000-mapping.dmp
-
memory/3760-160-0x0000000000000000-mapping.dmp
-
memory/3788-134-0x0000000000000000-mapping.dmp
-
memory/3804-128-0x0000000000000000-mapping.dmp
-
memory/3828-139-0x0000000000000000-mapping.dmp
-
memory/3876-145-0x0000000000000000-mapping.dmp
-
memory/3880-130-0x0000000000000000-mapping.dmp
-
memory/3888-154-0x0000000000000000-mapping.dmp
-
memory/4080-170-0x0000000000000000-mapping.dmp