3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe

General

Target

3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe
Size

69KB
MD5

39e9f9122c402cd0efed78ea35e64e13
SHA1

11ad4721f9e4b5da75a70dfdcfa52b5b95a3c235
SHA256

3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe
SHA512

c21ed41ed240a6244d5419ca5cafa11ce8374f85099441dd741a11252c0560b9afaea209cd1f47ed9b4fcaf362308a7fd8eb6f5e582fe7c5e6e3105e0a1724b2

Score

10^/10

persistence suricata

Malware Config

Signatures

suricata: ET MALWARE Observed GandCrab Domain (gandcrab .bit)
suricata: ET MALWARE Observed GandCrab Domain (gandcrab .bit)
suricata

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\jhdqkrvcdqv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe"	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe

description	ioc	process
File opened (read-only)	\??\X:	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe
File opened (read-only)	\??\G:	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe
File opened (read-only)	\??\J:	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe
File opened (read-only)	\??\K:	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe
File opened (read-only)	\??\M:	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe
File opened (read-only)	\??\Y:	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe
File opened (read-only)	\??\Z:	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe
File opened (read-only)	\??\H:	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe
File opened (read-only)	\??\L:	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe
File opened (read-only)	\??\R:	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe
File opened (read-only)	\??\W:	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe
File opened (read-only)	\??\S:	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe
File opened (read-only)	\??\V:	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe
File opened (read-only)	\??\B:	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe
File opened (read-only)	\??\F:	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe
File opened (read-only)	\??\O:	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe
File opened (read-only)	\??\Q:	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe
File opened (read-only)	\??\P:	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe
File opened (read-only)	\??\T:	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe
File opened (read-only)	\??\U:	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe
File opened (read-only)	\??\A:	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe
File opened (read-only)	\??\E:	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe
File opened (read-only)	\??\I:	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe
File opened (read-only)	\??\N:	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe

pid	process
4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe
4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe
4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe
4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe

description	pid	process	target process
PID 4124 wrote to memory of 4392	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 4392	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 4392	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 1184	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 1184	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 1184	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 4452	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 4452	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 4452	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 4272	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 4272	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 4272	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 4356	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 4356	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 4356	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 1176	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 1176	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 1176	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 628	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 628	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 628	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 4496	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 4496	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 4496	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 1972	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 1972	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 1972	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 4628	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 4628	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 4628	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 4776	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 4776	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 4776	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 1628	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 1628	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 1628	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 4668	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 4668	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 4668	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 4692	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 4692	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 4692	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 4632	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 4632	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 4632	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 4828	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 4828	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 4828	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 932	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 932	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 932	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 2516	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 2516	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 2516	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 2120	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 2120	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 2120	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 3480	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 3480	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 3480	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 1724	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 1724	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 1724	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe
PID 4124 wrote to memory of 1080	4124	3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe	nslookup.exe

C:\Users\Admin\AppData\Local\Temp\3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe
"C:\Users\Admin\AppData\Local\Temp\3679d32f9f3fa501e2790cad788ac39122d9b551af1907f4fdc30b8e2c9d5abe.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4124

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:4392

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1184

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:4452

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:4272

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:4356

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1176

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:628

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:4496

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1972

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:4628

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:4776

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1628

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:4668

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:4692

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:4632

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:4828

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:932

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:2516

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:2120

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:3480

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1724

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:1080

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:4156

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:2500

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:2732

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:5032

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1876

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:3272

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:1068

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1028

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:3840

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1248

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:2032

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:2628

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:2320

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:2712

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:5084

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1300

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:3868

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:3708

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:540

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:3644

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1264

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1076

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:2776

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:3640

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:968

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1252

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:3340

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:3672

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:2460

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:4216

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:4340

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:4064

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:2488

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:4508

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:4700

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:4696

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:2360

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:3344

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:4300

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:2300

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:4092

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:4896

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:620

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:3620

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:3140

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:4604

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:4976

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:2284

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:4832

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1056

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1244

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:4948

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:4184

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:4472

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:1788

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1932

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:2072

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:2160

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1872

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:3080

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:2180

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1760

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:3776

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:3444

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:3784

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:4188

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:3476

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:3036

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:4332

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:4648

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:5016

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:5064

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:3800

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1472

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:4084

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1668

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1504

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:4388

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/540-170-0x0000000000000000-mapping.dmp

Download
memory/628-136-0x0000000000000000-mapping.dmp

Download
memory/932-146-0x0000000000000000-mapping.dmp

Download
memory/968-176-0x0000000000000000-mapping.dmp

Download
memory/1028-159-0x0000000000000000-mapping.dmp

Download
memory/1068-158-0x0000000000000000-mapping.dmp

Download
memory/1076-173-0x0000000000000000-mapping.dmp

Download
memory/1080-151-0x0000000000000000-mapping.dmp

Download
memory/1176-135-0x0000000000000000-mapping.dmp

Download
memory/1184-131-0x0000000000000000-mapping.dmp

Download
memory/1248-161-0x0000000000000000-mapping.dmp

Download
memory/1252-177-0x0000000000000000-mapping.dmp

Download
memory/1264-172-0x0000000000000000-mapping.dmp

Download
memory/1300-167-0x0000000000000000-mapping.dmp

Download
memory/1628-141-0x0000000000000000-mapping.dmp

Download
memory/1724-150-0x0000000000000000-mapping.dmp

Download
memory/1876-156-0x0000000000000000-mapping.dmp

Download
memory/1972-138-0x0000000000000000-mapping.dmp

Download
memory/2032-162-0x0000000000000000-mapping.dmp

Download
memory/2120-148-0x0000000000000000-mapping.dmp

Download
memory/2300-191-0x0000000000000000-mapping.dmp

Download
memory/2320-164-0x0000000000000000-mapping.dmp

Download
memory/2360-188-0x0000000000000000-mapping.dmp

Download
memory/2460-180-0x0000000000000000-mapping.dmp

Download
memory/2488-184-0x0000000000000000-mapping.dmp

Download
memory/2500-153-0x0000000000000000-mapping.dmp

Download
memory/2516-147-0x0000000000000000-mapping.dmp

Download
memory/2628-163-0x0000000000000000-mapping.dmp

Download
memory/2712-165-0x0000000000000000-mapping.dmp

Download
memory/2732-154-0x0000000000000000-mapping.dmp

Download
memory/2776-174-0x0000000000000000-mapping.dmp

Download
memory/3272-157-0x0000000000000000-mapping.dmp

Download
memory/3340-178-0x0000000000000000-mapping.dmp

Download
memory/3344-189-0x0000000000000000-mapping.dmp

Download
memory/3480-149-0x0000000000000000-mapping.dmp

Download
memory/3640-175-0x0000000000000000-mapping.dmp

Download
memory/3644-171-0x0000000000000000-mapping.dmp

Download
memory/3672-179-0x0000000000000000-mapping.dmp

Download
memory/3708-169-0x0000000000000000-mapping.dmp

Download
memory/3840-160-0x0000000000000000-mapping.dmp

Download
memory/3868-168-0x0000000000000000-mapping.dmp

Download
memory/4064-183-0x0000000000000000-mapping.dmp

Download
memory/4092-192-0x0000000000000000-mapping.dmp

Download
memory/4156-152-0x0000000000000000-mapping.dmp

Download
memory/4216-181-0x0000000000000000-mapping.dmp

Download
memory/4272-133-0x0000000000000000-mapping.dmp

Download
memory/4300-190-0x0000000000000000-mapping.dmp

Download
memory/4340-182-0x0000000000000000-mapping.dmp

Download
memory/4356-134-0x0000000000000000-mapping.dmp

Download
memory/4392-130-0x0000000000000000-mapping.dmp

Download
memory/4452-132-0x0000000000000000-mapping.dmp

Download
memory/4496-137-0x0000000000000000-mapping.dmp

Download
memory/4508-185-0x0000000000000000-mapping.dmp

Download
memory/4628-139-0x0000000000000000-mapping.dmp

Download
memory/4632-144-0x0000000000000000-mapping.dmp

Download
memory/4668-142-0x0000000000000000-mapping.dmp

Download
memory/4692-143-0x0000000000000000-mapping.dmp

Download
memory/4696-187-0x0000000000000000-mapping.dmp

Download
memory/4700-186-0x0000000000000000-mapping.dmp

Download
memory/4776-140-0x0000000000000000-mapping.dmp

Download
memory/4828-145-0x0000000000000000-mapping.dmp

Download
memory/4896-193-0x0000000000000000-mapping.dmp

Download
memory/5032-155-0x0000000000000000-mapping.dmp

Download
memory/5084-166-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads