Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
03-07-2022 05:48
Static task
static1
Behavioral task
behavioral1
Sample
3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe
Resource
win10v2004-20220414-en
General
-
Target
3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe
-
Size
243KB
-
MD5
9b0653866e42c32d2af4affa0a6e944b
-
SHA1
9d356238ff76e61e03eceff15e51560a30ca4114
-
SHA256
3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7
-
SHA512
fe16c546e0e478916461ea7e108fc28f011254e5c2ccbd4d1d29a0c9ac8269279613a0dbef9dabd587f1fbfd151e979ad458b4b451072a8008e3daba39bb35ca
Malware Config
Signatures
-
GandCrab Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1964-56-0x0000000000400000-0x0000000000499000-memory.dmp family_gandcrab behavioral1/memory/1964-59-0x0000000000400000-0x0000000000499000-memory.dmp family_gandcrab behavioral1/memory/1964-60-0x0000000000240000-0x0000000000257000-memory.dmp family_gandcrab behavioral1/memory/1964-65-0x0000000000240000-0x0000000000257000-memory.dmp family_gandcrab -
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
suricata: ET MALWARE Observed GandCrab Ransomware Domain (carder .bit in DNS Lookup)
suricata: ET MALWARE Observed GandCrab Ransomware Domain (carder .bit in DNS Lookup)
-
suricata: ET MALWARE Observed GandCrab Ransomware Domain (ransomware .bit in DNS Lookup)
suricata: ET MALWARE Observed GandCrab Ransomware Domain (ransomware .bit in DNS Lookup)
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fkbwqebgdjc = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\wwkmsc.exe\"" 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exedescription ioc process File opened (read-only) \??\R: 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe File opened (read-only) \??\T: 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe File opened (read-only) \??\A: 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe File opened (read-only) \??\F: 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe File opened (read-only) \??\J: 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe File opened (read-only) \??\K: 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe File opened (read-only) \??\L: 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe File opened (read-only) \??\P: 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe File opened (read-only) \??\W: 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe File opened (read-only) \??\Y: 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe File opened (read-only) \??\G: 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe File opened (read-only) \??\I: 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe File opened (read-only) \??\X: 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe File opened (read-only) \??\S: 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe File opened (read-only) \??\U: 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe File opened (read-only) \??\B: 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe File opened (read-only) \??\E: 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe File opened (read-only) \??\H: 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe File opened (read-only) \??\M: 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe File opened (read-only) \??\N: 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe File opened (read-only) \??\Q: 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe File opened (read-only) \??\Z: 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe File opened (read-only) \??\O: 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe File opened (read-only) \??\V: 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe -
Drops file in Windows directory 1 IoCs
Processes:
3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exedescription ioc process File opened for modification C:\Windows\win.ini 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exepid process 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exedescription pid process target process PID 1964 wrote to memory of 1108 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 1108 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 1108 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 1108 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 940 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 940 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 940 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 940 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 520 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 520 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 520 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 520 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 324 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 324 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 324 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 324 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 892 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 892 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 892 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 892 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 1336 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 1336 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 1336 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 1336 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 896 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 896 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 896 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 896 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 1816 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 1816 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 1816 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 1816 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 1968 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 1968 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 1968 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 1968 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 1368 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 1368 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 1368 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 1368 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 1528 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 1528 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 1528 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 1528 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 568 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 568 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 568 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 568 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 1280 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 1280 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 1280 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 1280 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 1080 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 1080 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 1080 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 1080 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 560 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 560 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 560 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 560 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 1688 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 1688 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 1688 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe PID 1964 wrote to memory of 1688 1964 3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe nslookup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe"C:\Users\Admin\AppData\Local\Temp\3ca4020551bfda5ad08253c4248545eecbffb74f3cfd8eac3e7734eb383827e7.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/240-111-0x0000000000000000-mapping.dmp
-
memory/324-64-0x0000000000000000-mapping.dmp
-
memory/384-104-0x0000000000000000-mapping.dmp
-
memory/468-80-0x0000000000000000-mapping.dmp
-
memory/520-63-0x0000000000000000-mapping.dmp
-
memory/560-76-0x0000000000000000-mapping.dmp
-
memory/568-73-0x0000000000000000-mapping.dmp
-
memory/580-85-0x0000000000000000-mapping.dmp
-
memory/592-82-0x0000000000000000-mapping.dmp
-
memory/648-99-0x0000000000000000-mapping.dmp
-
memory/676-124-0x0000000000000000-mapping.dmp
-
memory/772-115-0x0000000000000000-mapping.dmp
-
memory/800-114-0x0000000000000000-mapping.dmp
-
memory/820-97-0x0000000000000000-mapping.dmp
-
memory/860-96-0x0000000000000000-mapping.dmp
-
memory/864-90-0x0000000000000000-mapping.dmp
-
memory/892-66-0x0000000000000000-mapping.dmp
-
memory/896-68-0x0000000000000000-mapping.dmp
-
memory/912-84-0x0000000000000000-mapping.dmp
-
memory/940-62-0x0000000000000000-mapping.dmp
-
memory/952-105-0x0000000000000000-mapping.dmp
-
memory/964-106-0x0000000000000000-mapping.dmp
-
memory/992-89-0x0000000000000000-mapping.dmp
-
memory/996-103-0x0000000000000000-mapping.dmp
-
memory/1056-98-0x0000000000000000-mapping.dmp
-
memory/1080-75-0x0000000000000000-mapping.dmp
-
memory/1100-120-0x0000000000000000-mapping.dmp
-
memory/1108-61-0x0000000000000000-mapping.dmp
-
memory/1156-122-0x0000000000000000-mapping.dmp
-
memory/1192-108-0x0000000000000000-mapping.dmp
-
memory/1204-83-0x0000000000000000-mapping.dmp
-
memory/1280-74-0x0000000000000000-mapping.dmp
-
memory/1296-109-0x0000000000000000-mapping.dmp
-
memory/1312-78-0x0000000000000000-mapping.dmp
-
memory/1336-67-0x0000000000000000-mapping.dmp
-
memory/1340-79-0x0000000000000000-mapping.dmp
-
memory/1368-71-0x0000000000000000-mapping.dmp
-
memory/1388-125-0x0000000000000000-mapping.dmp
-
memory/1452-117-0x0000000000000000-mapping.dmp
-
memory/1492-88-0x0000000000000000-mapping.dmp
-
memory/1528-72-0x0000000000000000-mapping.dmp
-
memory/1564-91-0x0000000000000000-mapping.dmp
-
memory/1576-110-0x0000000000000000-mapping.dmp
-
memory/1592-92-0x0000000000000000-mapping.dmp
-
memory/1616-121-0x0000000000000000-mapping.dmp
-
memory/1620-118-0x0000000000000000-mapping.dmp
-
memory/1668-93-0x0000000000000000-mapping.dmp
-
memory/1676-112-0x0000000000000000-mapping.dmp
-
memory/1688-77-0x0000000000000000-mapping.dmp
-
memory/1700-81-0x0000000000000000-mapping.dmp
-
memory/1712-95-0x0000000000000000-mapping.dmp
-
memory/1732-119-0x0000000000000000-mapping.dmp
-
memory/1764-116-0x0000000000000000-mapping.dmp
-
memory/1776-101-0x0000000000000000-mapping.dmp
-
memory/1816-69-0x0000000000000000-mapping.dmp
-
memory/1864-123-0x0000000000000000-mapping.dmp
-
memory/1888-86-0x0000000000000000-mapping.dmp
-
memory/1892-102-0x0000000000000000-mapping.dmp
-
memory/1912-87-0x0000000000000000-mapping.dmp
-
memory/1948-107-0x0000000000000000-mapping.dmp
-
memory/1964-65-0x0000000000240000-0x0000000000257000-memory.dmpFilesize
92KB
-
memory/1964-59-0x0000000000400000-0x0000000000499000-memory.dmpFilesize
612KB
-
memory/1964-56-0x0000000000400000-0x0000000000499000-memory.dmpFilesize
612KB
-
memory/1964-60-0x0000000000240000-0x0000000000257000-memory.dmpFilesize
92KB
-
memory/1964-54-0x0000000000220000-0x000000000023B000-memory.dmpFilesize
108KB
-
memory/1964-55-0x0000000000400000-0x0000000000499000-memory.dmpFilesize
612KB
-
memory/1964-57-0x0000000075401000-0x0000000075403000-memory.dmpFilesize
8KB
-
memory/1968-70-0x0000000000000000-mapping.dmp
-
memory/1988-94-0x0000000000000000-mapping.dmp
-
memory/2008-100-0x0000000000000000-mapping.dmp
-
memory/2036-113-0x0000000000000000-mapping.dmp