5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
24-07-2022 23:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe
Size

69KB
MD5

7c4dfdb7872e5a6869a1906178c57d0c
SHA1

0692d334698194dd26e06889b1cd7be32096e6da
SHA256

5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9
SHA512

de9a42f6b61262763df75f4dbb66f157f341260ba0bb84ac22902a8f4ceb9576a4f67276ca7d885bb835476c02b25ef560613674297baae73a61a288185dd235

Score

10^/10

persistence suricata

Malware Config

Signatures

suricata: ET MALWARE Observed GandCrab Domain (gandcrab .bit)
suricata: ET MALWARE Observed GandCrab Domain (gandcrab .bit)
suricata

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\mctnnbabsdw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe"	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe

description	ioc	process
File opened (read-only)	\??\S:	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe
File opened (read-only)	\??\U:	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe
File opened (read-only)	\??\V:	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe
File opened (read-only)	\??\B:	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe
File opened (read-only)	\??\F:	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe
File opened (read-only)	\??\H:	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe
File opened (read-only)	\??\I:	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe
File opened (read-only)	\??\L:	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe
File opened (read-only)	\??\R:	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe
File opened (read-only)	\??\Y:	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe
File opened (read-only)	\??\Z:	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe
File opened (read-only)	\??\J:	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe
File opened (read-only)	\??\M:	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe
File opened (read-only)	\??\N:	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe
File opened (read-only)	\??\O:	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe
File opened (read-only)	\??\Q:	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe
File opened (read-only)	\??\A:	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe
File opened (read-only)	\??\G:	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe
File opened (read-only)	\??\K:	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe
File opened (read-only)	\??\P:	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe
File opened (read-only)	\??\X:	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe
File opened (read-only)	\??\E:	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe
File opened (read-only)	\??\T:	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe
File opened (read-only)	\??\W:	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe

pid	process
2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe
2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe

description	pid	process	target process
PID 2020 wrote to memory of 1304	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 1304	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 1304	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 1304	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 816	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 816	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 816	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 816	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 304	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 304	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 304	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 304	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 1616	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 1616	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 1616	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 1616	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 1744	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 1744	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 1744	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 1744	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 1368	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 1368	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 1368	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 1368	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 1828	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 1828	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 1828	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 1828	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 552	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 552	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 552	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 552	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 2016	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 2016	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 2016	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 2016	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 1984	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 1984	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 1984	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 1984	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 1756	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 1756	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 1756	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 1756	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 1040	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 1040	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 1040	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 1040	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 276	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 276	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 276	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 276	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 1592	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 1592	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 1592	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 1592	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 2044	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 2044	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 2044	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 2044	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 516	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 516	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 516	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe
PID 2020 wrote to memory of 516	2020	5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe	nslookup.exe

C:\Users\Admin\AppData\Local\Temp\5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe
"C:\Users\Admin\AppData\Local\Temp\5745ab39e594f8a65e33196bef1de6fa421019f23b59319d707ea99d281b00a9.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1304
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:816
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:304
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1616
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1744
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:1368
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1828
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:552
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2016
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1984
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1756
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:1040
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:276
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1592
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2044
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:516
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1660
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:1420
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2000
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:388
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1472
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1716
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1688
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:1712
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:792
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:624
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1316
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1644
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1020
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:1520
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1344
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:744
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:904
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1612
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1780
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:332
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1356
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1792
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1748
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1752
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2024
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:1696
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:968
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1096
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1732
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1632
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:436
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:860
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1800
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:916
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1836
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1884
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:908
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2004
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:684
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1600
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1484
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1704
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1380
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:1824
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:988
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1628
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1292
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1804
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1636
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:1952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/276-67-0x0000000000000000-mapping.dmp

Download
memory/304-57-0x0000000000000000-mapping.dmp

Download
memory/332-90-0x0000000000000000-mapping.dmp

Download
memory/388-74-0x0000000000000000-mapping.dmp

Download
memory/436-101-0x0000000000000000-mapping.dmp

Download
memory/516-70-0x0000000000000000-mapping.dmp

Download
memory/552-62-0x0000000000000000-mapping.dmp

Download
memory/624-80-0x0000000000000000-mapping.dmp

Download
memory/684-109-0x0000000000000000-mapping.dmp

Download
memory/744-86-0x0000000000000000-mapping.dmp

Download
memory/792-79-0x0000000000000000-mapping.dmp

Download
memory/816-56-0x0000000000000000-mapping.dmp

Download
memory/860-102-0x0000000000000000-mapping.dmp

Download
memory/904-87-0x0000000000000000-mapping.dmp

Download
memory/908-107-0x0000000000000000-mapping.dmp

Download
memory/916-104-0x0000000000000000-mapping.dmp

Download
memory/968-97-0x0000000000000000-mapping.dmp

Download
memory/988-115-0x0000000000000000-mapping.dmp

Download
memory/1020-83-0x0000000000000000-mapping.dmp

Download
memory/1040-66-0x0000000000000000-mapping.dmp

Download
memory/1096-98-0x0000000000000000-mapping.dmp

Download
memory/1292-117-0x0000000000000000-mapping.dmp

Download
memory/1304-55-0x0000000000000000-mapping.dmp

Download
memory/1316-81-0x0000000000000000-mapping.dmp

Download
memory/1344-85-0x0000000000000000-mapping.dmp

Download
memory/1356-91-0x0000000000000000-mapping.dmp

Download
memory/1368-60-0x0000000000000000-mapping.dmp

Download
memory/1380-113-0x0000000000000000-mapping.dmp

Download
memory/1420-72-0x0000000000000000-mapping.dmp

Download
memory/1472-75-0x0000000000000000-mapping.dmp

Download
memory/1484-111-0x0000000000000000-mapping.dmp

Download
memory/1520-84-0x0000000000000000-mapping.dmp

Download
memory/1592-68-0x0000000000000000-mapping.dmp

Download
memory/1600-110-0x0000000000000000-mapping.dmp

Download
memory/1612-88-0x0000000000000000-mapping.dmp

Download
memory/1616-58-0x0000000000000000-mapping.dmp

Download
memory/1628-116-0x0000000000000000-mapping.dmp

Download
memory/1632-100-0x0000000000000000-mapping.dmp

Download
memory/1644-82-0x0000000000000000-mapping.dmp

Download
memory/1660-71-0x0000000000000000-mapping.dmp

Download
memory/1688-77-0x0000000000000000-mapping.dmp

Download
memory/1696-96-0x0000000000000000-mapping.dmp

Download
memory/1704-112-0x0000000000000000-mapping.dmp

Download
memory/1712-78-0x0000000000000000-mapping.dmp

Download
memory/1716-76-0x0000000000000000-mapping.dmp

Download
memory/1732-99-0x0000000000000000-mapping.dmp

Download
memory/1744-59-0x0000000000000000-mapping.dmp

Download
memory/1748-93-0x0000000000000000-mapping.dmp

Download
memory/1752-94-0x0000000000000000-mapping.dmp

Download
memory/1756-65-0x0000000000000000-mapping.dmp

Download
memory/1780-89-0x0000000000000000-mapping.dmp

Download
memory/1792-92-0x0000000000000000-mapping.dmp

Download
memory/1800-103-0x0000000000000000-mapping.dmp

Download
memory/1804-118-0x0000000000000000-mapping.dmp

Download
memory/1824-114-0x0000000000000000-mapping.dmp

Download
memory/1828-61-0x0000000000000000-mapping.dmp

Download
memory/1836-105-0x0000000000000000-mapping.dmp

Download
memory/1884-106-0x0000000000000000-mapping.dmp

Download
memory/1984-64-0x0000000000000000-mapping.dmp

Download
memory/2000-73-0x0000000000000000-mapping.dmp

Download
memory/2004-108-0x0000000000000000-mapping.dmp

Download
memory/2016-63-0x0000000000000000-mapping.dmp

Download
memory/2020-54-0x0000000076031000-0x0000000076033000-memory.dmp

Filesize
8KB

Download
memory/2024-95-0x0000000000000000-mapping.dmp

Download
memory/2044-69-0x0000000000000000-mapping.dmp

Download