5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588

General

Target

5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe
Size

69KB
MD5

c87568abcff8af054b35812c1752144b
SHA1

4361d2d3a072491d3544ff0f3bff3af9a6989546
SHA256

5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588
SHA512

3ffae5426a7ef63fb7c0eb7c91f003b37f0f1b98e71030350a6cf06dcf482897d2736b8253e5ec0d585e63f3b3a4c19b0badc45fe77c94db27e9f963a39e3489

Score

10^/10

persistence suricata

Malware Config

Signatures

suricata: ET MALWARE Observed GandCrab Domain (gandcrab .bit)
suricata: ET MALWARE Observed GandCrab Domain (gandcrab .bit)
suricata

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\xhiadgwqugz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe"	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe

description	ioc	process
File opened (read-only)	\??\H:	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe
File opened (read-only)	\??\I:	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe
File opened (read-only)	\??\J:	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe
File opened (read-only)	\??\M:	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe
File opened (read-only)	\??\N:	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe
File opened (read-only)	\??\O:	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe
File opened (read-only)	\??\S:	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe
File opened (read-only)	\??\U:	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe
File opened (read-only)	\??\A:	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe
File opened (read-only)	\??\K:	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe
File opened (read-only)	\??\L:	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe
File opened (read-only)	\??\T:	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe
File opened (read-only)	\??\X:	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe
File opened (read-only)	\??\Z:	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe
File opened (read-only)	\??\B:	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe
File opened (read-only)	\??\F:	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe
File opened (read-only)	\??\P:	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe
File opened (read-only)	\??\Q:	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe
File opened (read-only)	\??\R:	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe
File opened (read-only)	\??\W:	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe
File opened (read-only)	\??\E:	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe
File opened (read-only)	\??\G:	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe
File opened (read-only)	\??\V:	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe
File opened (read-only)	\??\Y:	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe

pid	process
4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe
4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe
4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe
4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe

description	pid	process	target process
PID 4828 wrote to memory of 912	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 912	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 912	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 3884	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 3884	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 3884	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 1460	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 1460	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 1460	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 1572	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 1572	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 1572	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 4800	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 4800	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 4800	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 3900	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 3900	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 3900	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 2548	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 2548	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 2548	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 5068	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 5068	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 5068	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 4932	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 4932	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 4932	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 1424	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 1424	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 1424	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 3596	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 3596	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 3596	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 2468	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 2468	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 2468	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 1748	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 1748	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 1748	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 4380	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 4380	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 4380	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 2532	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 2532	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 2532	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 2164	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 2164	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 2164	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 1164	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 1164	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 1164	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 3140	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 3140	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 3140	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 4388	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 4388	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 4388	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 4080	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 4080	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 4080	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 2752	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 2752	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 2752	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe
PID 4828 wrote to memory of 4996	4828	5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe	nslookup.exe

C:\Users\Admin\AppData\Local\Temp\5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe
"C:\Users\Admin\AppData\Local\Temp\5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4828

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:912

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:3884

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1460

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:1572

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:4800

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:3900

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:2548

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:5068

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:4932

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:1424

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:3596

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:2468

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1748

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:4380

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:2532

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:2164

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:1164

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:3140

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:4388

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:4080

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:2752

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:4996

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:2776

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1900

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1520

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:3516

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1436

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:4448

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:224

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:3440

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:2740

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:3132

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1364

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:4488

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:4908

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:3972

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:576

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:3564

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:2376

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:2192

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:4560

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:4600

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1344

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:4212

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:1880

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:2908

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:2388

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:2700

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:888

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:4848

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:968

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:4548

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:4056

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:3608

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:1324

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:4076

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:4540

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:2104

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:2256

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1724

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:228

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:2148

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:2992

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:4352

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:4232

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:3636

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:508

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1772

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:3304

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:312

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:2056

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:2016

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:4468

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:2936

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:4960

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:4984

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:2492

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1580

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:2844

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1632

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:3808

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:2416

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:4396

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:4192

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:2472

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:4204

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:3508

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:2308

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:4796

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:764

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:2268

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:368

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:2340

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:4356

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:1116

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:3828

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:544

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:1072

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:4504

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:5084

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:3856

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:3256

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:4792

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:4496

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns2.soprodns.ru
2⤵
PID:4520

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns2.soprodns.ru
2⤵
PID:2928

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns2.soprodns.ru
2⤵
PID:3436

C:\Windows\SysWOW64\nslookup.exe
nslookup gandcrab.bit dns1.soprodns.ru
2⤵
PID:1084

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.coin dns1.soprodns.ru
2⤵
PID:2328

C:\Windows\SysWOW64\nslookup.exe
nslookup nomoreransom.bit dns1.soprodns.ru
2⤵
PID:2980

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/224-160-0x0000000000000000-mapping.dmp

Download
memory/228-192-0x0000000000000000-mapping.dmp

Download
memory/576-168-0x0000000000000000-mapping.dmp

Download
memory/888-180-0x0000000000000000-mapping.dmp

Download
memory/912-132-0x0000000000000000-mapping.dmp

Download
memory/968-182-0x0000000000000000-mapping.dmp

Download
memory/1164-148-0x0000000000000000-mapping.dmp

Download
memory/1324-186-0x0000000000000000-mapping.dmp

Download
memory/1344-174-0x0000000000000000-mapping.dmp

Download
memory/1364-164-0x0000000000000000-mapping.dmp

Download
memory/1424-141-0x0000000000000000-mapping.dmp

Download
memory/1436-158-0x0000000000000000-mapping.dmp

Download
memory/1460-134-0x0000000000000000-mapping.dmp

Download
memory/1520-156-0x0000000000000000-mapping.dmp

Download
memory/1572-135-0x0000000000000000-mapping.dmp

Download
memory/1724-191-0x0000000000000000-mapping.dmp

Download
memory/1748-144-0x0000000000000000-mapping.dmp

Download
memory/1880-176-0x0000000000000000-mapping.dmp

Download
memory/1900-155-0x0000000000000000-mapping.dmp

Download
memory/2104-189-0x0000000000000000-mapping.dmp

Download
memory/2148-193-0x0000000000000000-mapping.dmp

Download
memory/2164-147-0x0000000000000000-mapping.dmp

Download
memory/2192-171-0x0000000000000000-mapping.dmp

Download
memory/2256-190-0x0000000000000000-mapping.dmp

Download
memory/2376-170-0x0000000000000000-mapping.dmp

Download
memory/2388-178-0x0000000000000000-mapping.dmp

Download
memory/2468-143-0x0000000000000000-mapping.dmp

Download
memory/2532-146-0x0000000000000000-mapping.dmp

Download
memory/2548-138-0x0000000000000000-mapping.dmp

Download
memory/2700-179-0x0000000000000000-mapping.dmp

Download
memory/2740-162-0x0000000000000000-mapping.dmp

Download
memory/2752-152-0x0000000000000000-mapping.dmp

Download
memory/2776-154-0x0000000000000000-mapping.dmp

Download
memory/2908-177-0x0000000000000000-mapping.dmp

Download
memory/2992-194-0x0000000000000000-mapping.dmp

Download
memory/3132-163-0x0000000000000000-mapping.dmp

Download
memory/3140-149-0x0000000000000000-mapping.dmp

Download
memory/3440-161-0x0000000000000000-mapping.dmp

Download
memory/3516-157-0x0000000000000000-mapping.dmp

Download
memory/3564-169-0x0000000000000000-mapping.dmp

Download
memory/3596-142-0x0000000000000000-mapping.dmp

Download
memory/3608-185-0x0000000000000000-mapping.dmp

Download
memory/3884-133-0x0000000000000000-mapping.dmp

Download
memory/3900-137-0x0000000000000000-mapping.dmp

Download
memory/3972-167-0x0000000000000000-mapping.dmp

Download
memory/4056-184-0x0000000000000000-mapping.dmp

Download
memory/4076-187-0x0000000000000000-mapping.dmp

Download
memory/4080-151-0x0000000000000000-mapping.dmp

Download
memory/4212-175-0x0000000000000000-mapping.dmp

Download
memory/4352-195-0x0000000000000000-mapping.dmp

Download
memory/4380-145-0x0000000000000000-mapping.dmp

Download
memory/4388-150-0x0000000000000000-mapping.dmp

Download
memory/4448-159-0x0000000000000000-mapping.dmp

Download
memory/4488-165-0x0000000000000000-mapping.dmp

Download
memory/4540-188-0x0000000000000000-mapping.dmp

Download
memory/4548-183-0x0000000000000000-mapping.dmp

Download
memory/4560-172-0x0000000000000000-mapping.dmp

Download
memory/4600-173-0x0000000000000000-mapping.dmp

Download
memory/4800-136-0x0000000000000000-mapping.dmp

Download
memory/4848-181-0x0000000000000000-mapping.dmp

Download
memory/4908-166-0x0000000000000000-mapping.dmp

Download
memory/4932-140-0x0000000000000000-mapping.dmp

Download
memory/4996-153-0x0000000000000000-mapping.dmp

Download
memory/5068-139-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads