gandcrab | 3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c

General

Target

3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe
Size

254KB
MD5

200914872736a72a37d2433460f4dfb7
SHA1

c9d8bb9fd2472f1af12bfb3a9594e4ad767e8361
SHA256

3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c
SHA512

95b2ef953e80f81a535de70e359cf14055621f0cc6f3e54247258cd7781f6db7ad38a2457f5523ce25d252a53ad52cab7230fe7da662d582fc1fe67acac38f3a

Score

10^/10

gandcrab backdoor persistence ransomware suricata

Malware Config

Signatures

GandCrab Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1612-55-0x0000000000400000-0x0000000000447000-memory.dmp	family_gandcrab
behavioral1/memory/1612-58-0x0000000000400000-0x0000000000447000-memory.dmp	family_gandcrab
behavioral1/memory/1612-59-0x0000000000230000-0x0000000000254000-memory.dmp	family_gandcrab
behavioral1/memory/1612-64-0x0000000000230000-0x0000000000254000-memory.dmp	family_gandcrab

Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab
suricata: ET MALWARE Observed GandCrab Domain (gandcrab .bit)
suricata: ET MALWARE Observed GandCrab Domain (gandcrab .bit)
suricata

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\fbovhrrvaha = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe"	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe

description	ioc	process
File opened (read-only)	\??\F:	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe
File opened (read-only)	\??\T:	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe
File opened (read-only)	\??\X:	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe
File opened (read-only)	\??\W:	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe
File opened (read-only)	\??\G:	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe
File opened (read-only)	\??\M:	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe
File opened (read-only)	\??\N:	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe
File opened (read-only)	\??\O:	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe
File opened (read-only)	\??\U:	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe
File opened (read-only)	\??\K:	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe
File opened (read-only)	\??\L:	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe
File opened (read-only)	\??\P:	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe
File opened (read-only)	\??\B:	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe
File opened (read-only)	\??\E:	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe
File opened (read-only)	\??\H:	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe
File opened (read-only)	\??\I:	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe
File opened (read-only)	\??\J:	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe
File opened (read-only)	\??\Q:	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe
File opened (read-only)	\??\R:	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe
File opened (read-only)	\??\S:	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe
File opened (read-only)	\??\Y:	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe
File opened (read-only)	\??\Z:	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe
File opened (read-only)	\??\A:	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe
File opened (read-only)	\??\V:	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe

pid	process
1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe
1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe

description	pid	process	target process
PID 1612 wrote to memory of 536	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 536	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 536	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 536	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 1936	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 1936	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 1936	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 1936	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 984	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 984	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 984	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 984	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 972	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 972	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 972	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 972	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 1640	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 1640	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 1640	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 1640	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 1744	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 1744	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 1744	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 1744	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 1716	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 1716	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 1716	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 1716	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 2040	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 2040	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 2040	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 2040	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 1308	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 1308	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 1308	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 1308	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 1228	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 1228	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 1228	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 1228	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 1552	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 1552	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 1552	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 1552	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 904	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 904	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 904	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 904	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 1600	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 1600	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 1600	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 1600	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 1264	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 1264	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 1264	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 1264	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 268	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 268	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 268	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 268	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 300	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 300	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 300	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe
PID 1612 wrote to memory of 300	1612	3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe	nslookup.exe

C:\Users\Admin\AppData\Local\Temp\3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe
"C:\Users\Admin\AppData\Local\Temp\3570b95ea454efd6735bf4942d69521d608ab7d0c9745cfa636f1107acc6a23c.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1612

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:536

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1936

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:984

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:972

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:1640

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1744

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1716

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:2040

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1308

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:1228

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:1552

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:904

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1600

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1264

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:268

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:300

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:1688

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1696

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:768

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1668

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:672

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:1804

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:456

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:848

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:688

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:112

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1348

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:1980

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:912

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:828

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1824

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1892

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:896

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:976

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:324

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1656

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1564

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1196

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1628

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:1188

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:1072

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1344

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1748

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:684

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1388

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:1236

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:340

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1380

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1784

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1856

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1516

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:772

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:1128

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1680

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1504

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1132

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:920

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:316

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:756

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1636

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:280

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1648

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1528

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/112-87-0x0000000000000000-mapping.dmp

Download
memory/268-76-0x0000000000000000-mapping.dmp

Download
memory/280-122-0x0000000000000000-mapping.dmp

Download
memory/300-77-0x0000000000000000-mapping.dmp

Download
memory/316-119-0x0000000000000000-mapping.dmp

Download
memory/324-96-0x0000000000000000-mapping.dmp

Download
memory/340-108-0x0000000000000000-mapping.dmp

Download
memory/456-84-0x0000000000000000-mapping.dmp

Download
memory/536-60-0x0000000000000000-mapping.dmp

Download
memory/672-82-0x0000000000000000-mapping.dmp

Download
memory/684-105-0x0000000000000000-mapping.dmp

Download
memory/688-86-0x0000000000000000-mapping.dmp

Download
memory/756-120-0x0000000000000000-mapping.dmp

Download
memory/768-80-0x0000000000000000-mapping.dmp

Download
memory/772-113-0x0000000000000000-mapping.dmp

Download
memory/828-91-0x0000000000000000-mapping.dmp

Download
memory/848-85-0x0000000000000000-mapping.dmp

Download
memory/896-94-0x0000000000000000-mapping.dmp

Download
memory/904-73-0x0000000000000000-mapping.dmp

Download
memory/912-90-0x0000000000000000-mapping.dmp

Download
memory/920-118-0x0000000000000000-mapping.dmp

Download
memory/972-65-0x0000000000000000-mapping.dmp

Download
memory/976-95-0x0000000000000000-mapping.dmp

Download
memory/984-62-0x0000000000000000-mapping.dmp

Download
memory/1072-102-0x0000000000000000-mapping.dmp

Download
memory/1128-114-0x0000000000000000-mapping.dmp

Download
memory/1132-117-0x0000000000000000-mapping.dmp

Download
memory/1188-101-0x0000000000000000-mapping.dmp

Download
memory/1196-99-0x0000000000000000-mapping.dmp

Download
memory/1228-71-0x0000000000000000-mapping.dmp

Download
memory/1236-107-0x0000000000000000-mapping.dmp

Download
memory/1264-75-0x0000000000000000-mapping.dmp

Download
memory/1308-70-0x0000000000000000-mapping.dmp

Download
memory/1344-103-0x0000000000000000-mapping.dmp

Download
memory/1348-88-0x0000000000000000-mapping.dmp

Download
memory/1380-109-0x0000000000000000-mapping.dmp

Download
memory/1388-106-0x0000000000000000-mapping.dmp

Download
memory/1504-116-0x0000000000000000-mapping.dmp

Download
memory/1516-112-0x0000000000000000-mapping.dmp

Download
memory/1528-124-0x0000000000000000-mapping.dmp

Download
memory/1552-72-0x0000000000000000-mapping.dmp

Download
memory/1564-98-0x0000000000000000-mapping.dmp

Download
memory/1600-74-0x0000000000000000-mapping.dmp

Download
memory/1612-64-0x0000000000230000-0x0000000000254000-memory.dmp

Filesize
144KB

Download
memory/1612-55-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1612-57-0x00000000005A2000-0x00000000005C1000-memory.dmp

Filesize
124KB

Download
memory/1612-58-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1612-54-0x0000000076531000-0x0000000076533000-memory.dmp

Filesize
8KB

Download
memory/1612-59-0x0000000000230000-0x0000000000254000-memory.dmp

Filesize
144KB

Download
memory/1612-63-0x00000000005A2000-0x00000000005C1000-memory.dmp

Filesize
124KB

Download
memory/1628-100-0x0000000000000000-mapping.dmp

Download
memory/1636-121-0x0000000000000000-mapping.dmp

Download
memory/1640-66-0x0000000000000000-mapping.dmp

Download
memory/1648-123-0x0000000000000000-mapping.dmp

Download
memory/1656-97-0x0000000000000000-mapping.dmp

Download
memory/1668-81-0x0000000000000000-mapping.dmp

Download
memory/1680-115-0x0000000000000000-mapping.dmp

Download
memory/1688-78-0x0000000000000000-mapping.dmp

Download
memory/1696-79-0x0000000000000000-mapping.dmp

Download
memory/1716-68-0x0000000000000000-mapping.dmp

Download
memory/1744-67-0x0000000000000000-mapping.dmp

Download
memory/1748-104-0x0000000000000000-mapping.dmp

Download
memory/1784-110-0x0000000000000000-mapping.dmp

Download
memory/1804-83-0x0000000000000000-mapping.dmp

Download
memory/1824-92-0x0000000000000000-mapping.dmp

Download
memory/1856-111-0x0000000000000000-mapping.dmp

Download
memory/1892-93-0x0000000000000000-mapping.dmp

Download
memory/1936-61-0x0000000000000000-mapping.dmp

Download
memory/1980-89-0x0000000000000000-mapping.dmp

Download
memory/2040-69-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads