gandcrab | 3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca

General

Target

3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe
Size

306KB
MD5

adfe502690be1a44154128734b8973f7
SHA1

c1f7c2d94a205ae72418ae3b33763c64a5db6bbe
SHA256

3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca
SHA512

4bc694f1877daccb70d467d6d29521be5a4a5045e54b074a54a5ca4e5ac86a17cd6e63471ecd5a839dad058cc65842ba8d4bd1e83952f6e54c67bb66931d66e4

Score

10^/10

gandcrab backdoor persistence ransomware suricata

Malware Config

Signatures

GandCrab Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1552-56-0x0000000000400000-0x000000000045C000-memory.dmp	family_gandcrab
behavioral1/memory/1552-59-0x0000000000400000-0x000000000045C000-memory.dmp	family_gandcrab
behavioral1/memory/1552-60-0x00000000002D0000-0x00000000002E7000-memory.dmp	family_gandcrab
behavioral1/memory/1552-65-0x00000000002D0000-0x00000000002E7000-memory.dmp	family_gandcrab

Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab
suricata: ET MALWARE Observed GandCrab Ransomware Domain (carder .bit in DNS Lookup)
suricata: ET MALWARE Observed GandCrab Ransomware Domain (carder .bit in DNS Lookup)
suricata
suricata: ET MALWARE Observed GandCrab Ransomware Domain (ransomware .bit in DNS Lookup)
suricata: ET MALWARE Observed GandCrab Ransomware Domain (ransomware .bit in DNS Lookup)
suricata

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pdtnnevddhk = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\ktzhea.exe\""	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe

description	ioc	process
File opened (read-only)	\??\A:	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe
File opened (read-only)	\??\T:	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe
File opened (read-only)	\??\L:	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe
File opened (read-only)	\??\M:	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe
File opened (read-only)	\??\Q:	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe
File opened (read-only)	\??\S:	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe
File opened (read-only)	\??\U:	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe
File opened (read-only)	\??\V:	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe
File opened (read-only)	\??\B:	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe
File opened (read-only)	\??\K:	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe
File opened (read-only)	\??\Y:	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe
File opened (read-only)	\??\P:	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe
File opened (read-only)	\??\R:	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe
File opened (read-only)	\??\W:	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe
File opened (read-only)	\??\X:	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe
File opened (read-only)	\??\Z:	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe
File opened (read-only)	\??\I:	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe
File opened (read-only)	\??\O:	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe
File opened (read-only)	\??\G:	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe
File opened (read-only)	\??\H:	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe
File opened (read-only)	\??\J:	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe
File opened (read-only)	\??\N:	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe
File opened (read-only)	\??\E:	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe
File opened (read-only)	\??\F:	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe

pid	process
1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe
1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe

description	pid	process	target process
PID 1552 wrote to memory of 320	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 320	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 320	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 320	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1692	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1692	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1692	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1692	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 928	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 928	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 928	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 928	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 548	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 548	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 548	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 548	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1744	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1744	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1744	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1744	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1576	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1576	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1576	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1576	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1968	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1968	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1968	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1968	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1128	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1128	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1128	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1128	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1644	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1644	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1644	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1644	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1944	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1944	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1944	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1944	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1368	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1368	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1368	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1368	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1804	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1804	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1804	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1804	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1792	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1792	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1792	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1792	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1912	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1912	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1912	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1912	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1752	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1752	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1752	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1752	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1584	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1584	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1584	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe
PID 1552 wrote to memory of 1584	1552	3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe	nslookup.exe

C:\Users\Admin\AppData\Local\Temp\3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe
"C:\Users\Admin\AppData\Local\Temp\3cdd857e90e3d210c991232d4c9de9339a7f2fa941aac7c7d27dc321b4e968ca.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1552

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:320

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:1692

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:928

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:548

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:1744

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:1576

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:1968

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:1128

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:1644

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:1944

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:1368

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:1804

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:1792

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:1912

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:1752

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:1584

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:1508

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:1628

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:1592

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:916

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:1004

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:1940

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:828

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:756

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:1800

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:1872

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:268

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:984

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:1516

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:1668

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:1376

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:280

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:1612

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:1580

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:616

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:1100

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:768

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:1748

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:308

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:1080

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:820

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:696

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:832

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:1116

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:672

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:1288

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:1444

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:944

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:1256

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:1728

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:1988

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:1248

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:1992

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:1916

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:1132

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:1660

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:572

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:1332

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:1028

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:1624

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:1600

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:1852

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:276

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:1620

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:588

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:564

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:1736

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:1928

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns1.wowservers.ru
2⤵
PID:1240

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns2.wowservers.ru
2⤵
PID:1336

C:\Windows\SysWOW64\nslookup.exe
nslookup carder.bit ns2.wowservers.ru
2⤵
PID:524

C:\Windows\SysWOW64\nslookup.exe
nslookup ransomware.bit ns1.wowservers.ru
2⤵
PID:1308

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/268-89-0x0000000000000000-mapping.dmp

Download
memory/276-125-0x0000000000000000-mapping.dmp

Download
memory/280-94-0x0000000000000000-mapping.dmp

Download
memory/308-101-0x0000000000000000-mapping.dmp

Download
memory/320-61-0x0000000000000000-mapping.dmp

Download
memory/548-66-0x0000000000000000-mapping.dmp

Download
memory/572-119-0x0000000000000000-mapping.dmp

Download
memory/616-97-0x0000000000000000-mapping.dmp

Download
memory/672-107-0x0000000000000000-mapping.dmp

Download
memory/696-104-0x0000000000000000-mapping.dmp

Download
memory/756-86-0x0000000000000000-mapping.dmp

Download
memory/768-99-0x0000000000000000-mapping.dmp

Download
memory/820-103-0x0000000000000000-mapping.dmp

Download
memory/828-85-0x0000000000000000-mapping.dmp

Download
memory/832-105-0x0000000000000000-mapping.dmp

Download
memory/916-82-0x0000000000000000-mapping.dmp

Download
memory/928-64-0x0000000000000000-mapping.dmp

Download
memory/944-110-0x0000000000000000-mapping.dmp

Download
memory/984-90-0x0000000000000000-mapping.dmp

Download
memory/1004-83-0x0000000000000000-mapping.dmp

Download
memory/1028-121-0x0000000000000000-mapping.dmp

Download
memory/1080-102-0x0000000000000000-mapping.dmp

Download
memory/1100-98-0x0000000000000000-mapping.dmp

Download
memory/1116-106-0x0000000000000000-mapping.dmp

Download
memory/1128-70-0x0000000000000000-mapping.dmp

Download
memory/1132-117-0x0000000000000000-mapping.dmp

Download
memory/1248-114-0x0000000000000000-mapping.dmp

Download
memory/1256-111-0x0000000000000000-mapping.dmp

Download
memory/1288-108-0x0000000000000000-mapping.dmp

Download
memory/1332-120-0x0000000000000000-mapping.dmp

Download
memory/1368-73-0x0000000000000000-mapping.dmp

Download
memory/1376-93-0x0000000000000000-mapping.dmp

Download
memory/1444-109-0x0000000000000000-mapping.dmp

Download
memory/1508-79-0x0000000000000000-mapping.dmp

Download
memory/1516-91-0x0000000000000000-mapping.dmp

Download
memory/1552-65-0x00000000002D0000-0x00000000002E7000-memory.dmp

Filesize
92KB

Download
memory/1552-54-0x0000000000520000-0x000000000053C000-memory.dmp

Filesize
112KB

Download
memory/1552-55-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1552-56-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1552-57-0x00000000759E1000-0x00000000759E3000-memory.dmp

Filesize
8KB

Download
memory/1552-59-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1552-60-0x00000000002D0000-0x00000000002E7000-memory.dmp

Filesize
92KB

Download
memory/1552-62-0x0000000000520000-0x000000000053C000-memory.dmp

Filesize
112KB

Download
memory/1576-68-0x0000000000000000-mapping.dmp

Download
memory/1580-96-0x0000000000000000-mapping.dmp

Download
memory/1584-78-0x0000000000000000-mapping.dmp

Download
memory/1592-81-0x0000000000000000-mapping.dmp

Download
memory/1600-123-0x0000000000000000-mapping.dmp

Download
memory/1612-95-0x0000000000000000-mapping.dmp

Download
memory/1620-126-0x0000000000000000-mapping.dmp

Download
memory/1624-122-0x0000000000000000-mapping.dmp

Download
memory/1628-80-0x0000000000000000-mapping.dmp

Download
memory/1644-71-0x0000000000000000-mapping.dmp

Download
memory/1660-118-0x0000000000000000-mapping.dmp

Download
memory/1668-92-0x0000000000000000-mapping.dmp

Download
memory/1692-63-0x0000000000000000-mapping.dmp

Download
memory/1728-112-0x0000000000000000-mapping.dmp

Download
memory/1744-67-0x0000000000000000-mapping.dmp

Download
memory/1748-100-0x0000000000000000-mapping.dmp

Download
memory/1752-77-0x0000000000000000-mapping.dmp

Download
memory/1792-75-0x0000000000000000-mapping.dmp

Download
memory/1800-87-0x0000000000000000-mapping.dmp

Download
memory/1804-74-0x0000000000000000-mapping.dmp

Download
memory/1852-124-0x0000000000000000-mapping.dmp

Download
memory/1872-88-0x0000000000000000-mapping.dmp

Download
memory/1912-76-0x0000000000000000-mapping.dmp

Download
memory/1916-116-0x0000000000000000-mapping.dmp

Download
memory/1940-84-0x0000000000000000-mapping.dmp

Download
memory/1944-72-0x0000000000000000-mapping.dmp

Download
memory/1968-69-0x0000000000000000-mapping.dmp

Download
memory/1988-113-0x0000000000000000-mapping.dmp

Download
memory/1992-115-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads