Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-10-2024 00:22

General

  • Target

    ad2bfcd8b7d5fdacfd51e29f8990f67ca3fdd3fe004b7c53e6fb72cdeaef3249N.exe

  • Size

    72KB

  • MD5

    4683b2f5ff3e5cda3c46a9944f534350

  • SHA1

    5c8a22e5dd200a90892170aff2d38874c15178a0

  • SHA256

    ad2bfcd8b7d5fdacfd51e29f8990f67ca3fdd3fe004b7c53e6fb72cdeaef3249

  • SHA512

    f9f1738186894b4a0607456c474193958a061d5ad33d82df2857c53ff18c4bae2b0d8ec22007ebea81ed1a750634f32d7e06d639f7b6f2e846d2415f3fc59502

  • SSDEEP

    1536:GZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAwfMqqU+2bbbAV2/S2Lkvd6:gBounVyFHpfMqqDL2/Lkvd6

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • System Location Discovery: System Language Discovery 1 TTPs 51 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ad2bfcd8b7d5fdacfd51e29f8990f67ca3fdd3fe004b7c53e6fb72cdeaef3249N.exe
    "C:\Users\Admin\AppData\Local\Temp\ad2bfcd8b7d5fdacfd51e29f8990f67ca3fdd3fe004b7c53e6fb72cdeaef3249N.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3096
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.coin dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4424
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.bit dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4896
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup gandcrab.bit dns2.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3512
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.coin dns2.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4856
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.bit dns2.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1844
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup gandcrab.bit dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3424
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.coin dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3156
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.bit dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4436
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup gandcrab.bit dns2.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4120
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.coin dns2.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:404
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.bit dns2.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4852
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup gandcrab.bit dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4468
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.coin dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3508
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.bit dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2476
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup gandcrab.bit dns2.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3100
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.coin dns2.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4872
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.bit dns2.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4208
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup gandcrab.bit dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2864
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.coin dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:412
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.bit dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4484
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup gandcrab.bit dns2.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4476
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.coin dns2.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1364
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.bit dns2.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2172
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup gandcrab.bit dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2240
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.coin dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4920
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.bit dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5080
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup gandcrab.bit dns2.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1588
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.coin dns2.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2804
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.bit dns2.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4688
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup gandcrab.bit dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2296
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.coin dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3692
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.bit dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3716
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup gandcrab.bit dns2.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4820
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.coin dns2.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4716
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.bit dns2.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3864
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup gandcrab.bit dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2268
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.coin dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:540
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.bit dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2232
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup gandcrab.bit dns2.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1048
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.coin dns2.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2576
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.bit dns2.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3460
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup gandcrab.bit dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:60
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.coin dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1420
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.bit dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3064
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup gandcrab.bit dns2.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2580
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.coin dns2.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2888
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.bit dns2.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3152
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup gandcrab.bit dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3000
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.coin dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1804
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.bit dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1068

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads