gandcrab | cb93ef8affa8e13b671190d1f8790aa08e0686097493d958e900659db2736841

Analysis

max time kernel
1791s
max time network
1793s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
11-11-2024 07:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe
Size

145KB
MD5

8141ae1b905d61f4e0d3534052e45364
SHA1

a9d17cd249f4f882d1e2128d7f25bd13b20d9da2
SHA256

0e47b58d99eaf5ca77f7c1b4e03e779992c7e9bf7860ec5e6cd817b4d9199b63
SHA512

cb980feeab2c4e8ccb28c0b0cefe827574fe0e7a2f7390dbb36aac78dd0f9c7501b8e4d78393f58c8edec3c88928a4b068992ebc6449b7739c2a0e8188aa30fa
SSDEEP

3072:PVWq+fziq1cEhIv/7M7BC/FTqdVY77C37R:Pn+fziq1VIv

Score

10^/10

gandcrab backdoor discovery ransomware

Malware Config

Signatures

GandCrab payload 59 IoCs

Processes:

resource	yara_rule
behavioral30/memory/2844-2-0x0000000000400000-0x0000000000416000-memory.dmp	family_gandcrab
behavioral30/memory/2844-5-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-6-0x0000000000400000-0x0000000000416000-memory.dmp	family_gandcrab
behavioral30/memory/2844-7-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-8-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-9-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-10-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-12-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-13-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-14-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-15-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-16-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-17-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-18-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-19-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-20-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-22-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-23-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-24-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-25-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-26-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-27-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-28-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-29-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-30-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-32-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-33-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-34-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-35-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-36-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-37-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-38-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-40-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-41-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-42-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-43-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-44-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-45-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-46-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-48-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-49-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-50-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-51-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-52-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-53-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-54-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-55-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-56-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-58-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-59-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-60-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-61-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-62-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-63-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-64-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-65-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-66-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-68-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab
behavioral30/memory/2844-69-0x0000000000400000-0x000000000042C000-memory.dmp	family_gandcrab

Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab
Gandcrab family
gandcrab

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description	ioc
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74
Destination IP	43.134.249.74

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe

description	ioc	Process
File opened (read-only)	\??\V:	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe
File opened (read-only)	\??\E:	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe
File opened (read-only)	\??\J:	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe
File opened (read-only)	\??\L:	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe
File opened (read-only)	\??\N:	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe
File opened (read-only)	\??\S:	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe
File opened (read-only)	\??\U:	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe
File opened (read-only)	\??\Y:	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe
File opened (read-only)	\??\B:	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe
File opened (read-only)	\??\G:	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe
File opened (read-only)	\??\M:	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe
File opened (read-only)	\??\Q:	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe
File opened (read-only)	\??\R:	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe
File opened (read-only)	\??\H:	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe
File opened (read-only)	\??\O:	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe
File opened (read-only)	\??\P:	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe
File opened (read-only)	\??\T:	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe
File opened (read-only)	\??\Z:	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe
File opened (read-only)	\??\A:	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe
File opened (read-only)	\??\I:	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe
File opened (read-only)	\??\K:	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe
File opened (read-only)	\??\W:	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe
File opened (read-only)	\??\X:	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

nslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exenslookup.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 32 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

Processes:

pid	Process
1932	nslookup.exe
3048	nslookup.exe
1992	nslookup.exe
2684	nslookup.exe
3052	nslookup.exe
2980	nslookup.exe
2732	nslookup.exe
1968	nslookup.exe
1568	nslookup.exe
1552	nslookup.exe
908	nslookup.exe
1292	nslookup.exe
2576	nslookup.exe
968	nslookup.exe
2208	nslookup.exe
1384	nslookup.exe
332	nslookup.exe
2120	nslookup.exe
2608	nslookup.exe
1652	nslookup.exe
2564	nslookup.exe
868	nslookup.exe
2716	nslookup.exe
2320	nslookup.exe
2888	nslookup.exe
1704	nslookup.exe
696	nslookup.exe
2164	nslookup.exe
2704	nslookup.exe
2400	nslookup.exe
2944	nslookup.exe
1308	nslookup.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe

pid	Process
2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe
2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe

description	pid	Process	procid_target
PID 2844 wrote to memory of 2788	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	30
PID 2844 wrote to memory of 2788	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	30
PID 2844 wrote to memory of 2788	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	30
PID 2844 wrote to memory of 2788	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	30
PID 2844 wrote to memory of 2704	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	33
PID 2844 wrote to memory of 2704	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	33
PID 2844 wrote to memory of 2704	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	33
PID 2844 wrote to memory of 2704	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	33
PID 2844 wrote to memory of 264	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	35
PID 2844 wrote to memory of 264	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	35
PID 2844 wrote to memory of 264	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	35
PID 2844 wrote to memory of 264	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	35
PID 2844 wrote to memory of 2220	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	38
PID 2844 wrote to memory of 2220	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	38
PID 2844 wrote to memory of 2220	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	38
PID 2844 wrote to memory of 2220	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	38
PID 2844 wrote to memory of 1520	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	40
PID 2844 wrote to memory of 1520	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	40
PID 2844 wrote to memory of 1520	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	40
PID 2844 wrote to memory of 1520	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	40
PID 2844 wrote to memory of 1312	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	42
PID 2844 wrote to memory of 1312	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	42
PID 2844 wrote to memory of 1312	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	42
PID 2844 wrote to memory of 1312	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	42
PID 2844 wrote to memory of 2716	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	44
PID 2844 wrote to memory of 2716	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	44
PID 2844 wrote to memory of 2716	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	44
PID 2844 wrote to memory of 2716	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	44
PID 2844 wrote to memory of 1576	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	46
PID 2844 wrote to memory of 1576	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	46
PID 2844 wrote to memory of 1576	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	46
PID 2844 wrote to memory of 1576	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	46
PID 2844 wrote to memory of 2244	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	48
PID 2844 wrote to memory of 2244	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	48
PID 2844 wrote to memory of 2244	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	48
PID 2844 wrote to memory of 2244	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	48
PID 2844 wrote to memory of 1976	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	50
PID 2844 wrote to memory of 1976	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	50
PID 2844 wrote to memory of 1976	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	50
PID 2844 wrote to memory of 1976	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	50
PID 2844 wrote to memory of 1660	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	52
PID 2844 wrote to memory of 1660	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	52
PID 2844 wrote to memory of 1660	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	52
PID 2844 wrote to memory of 1660	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	52
PID 2844 wrote to memory of 1292	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	54
PID 2844 wrote to memory of 1292	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	54
PID 2844 wrote to memory of 1292	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	54
PID 2844 wrote to memory of 1292	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	54
PID 2844 wrote to memory of 468	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	56
PID 2844 wrote to memory of 468	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	56
PID 2844 wrote to memory of 468	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	56
PID 2844 wrote to memory of 468	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	56
PID 2844 wrote to memory of 816	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	58
PID 2844 wrote to memory of 816	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	58
PID 2844 wrote to memory of 816	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	58
PID 2844 wrote to memory of 816	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	58
PID 2844 wrote to memory of 904	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	60
PID 2844 wrote to memory of 904	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	60
PID 2844 wrote to memory of 904	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	60
PID 2844 wrote to memory of 904	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	60
PID 2844 wrote to memory of 1944	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	62
PID 2844 wrote to memory of 1944	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	62
PID 2844 wrote to memory of 1944	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	62
PID 2844 wrote to memory of 1944	2844	2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe	62

C:\Users\Admin\AppData\Local\Temp\2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe
"C:\Users\Admin\AppData\Local\Temp\2018-01-28-Seamless-campaign-Rig-EK-payload-GandCrab-ransomware.exe"
1⤵
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit a.dnspod.com
  2⤵
  PID:2788
- C:\Windows\SysWOW64\nslookup.exe
  nslookup bleepingcomputer.bit a.dnspod.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2704
- C:\Windows\SysWOW64\nslookup.exe
  nslookup emsisoft.bit a.dnspod.com
  2⤵
  PID:264
- C:\Windows\SysWOW64\nslookup.exe
  nslookup esetnod32.bit a.dnspod.com
  2⤵
  PID:2220
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1520
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit a.dnspod.com
  2⤵
  PID:1312
- C:\Windows\SysWOW64\nslookup.exe
  nslookup bleepingcomputer.bit a.dnspod.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2716
- C:\Windows\SysWOW64\nslookup.exe
  nslookup emsisoft.bit a.dnspod.com
  2⤵
  PID:1576
- C:\Windows\SysWOW64\nslookup.exe
  nslookup esetnod32.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2244
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1976
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1660
- C:\Windows\SysWOW64\nslookup.exe
  nslookup bleepingcomputer.bit a.dnspod.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1292
- C:\Windows\SysWOW64\nslookup.exe
  nslookup emsisoft.bit a.dnspod.com
  2⤵
  PID:468
- C:\Windows\SysWOW64\nslookup.exe
  nslookup esetnod32.bit a.dnspod.com
  2⤵
  PID:816
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:904
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit a.dnspod.com
  2⤵
  PID:1944
- C:\Windows\SysWOW64\nslookup.exe
  nslookup bleepingcomputer.bit a.dnspod.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1932
- C:\Windows\SysWOW64\nslookup.exe
  nslookup emsisoft.bit a.dnspod.com
  2⤵
  PID:2768
- C:\Windows\SysWOW64\nslookup.exe
  nslookup esetnod32.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2828
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit a.dnspod.com
  2⤵
  PID:2764
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:892
- C:\Windows\SysWOW64\nslookup.exe
  nslookup bleepingcomputer.bit a.dnspod.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:332
- C:\Windows\SysWOW64\nslookup.exe
  nslookup emsisoft.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1488
- C:\Windows\SysWOW64\nslookup.exe
  nslookup esetnod32.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2572
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit a.dnspod.com
  2⤵
  PID:2104
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit a.dnspod.com
  2⤵
  PID:2228
- C:\Windows\SysWOW64\nslookup.exe
  nslookup bleepingcomputer.bit a.dnspod.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2980
- C:\Windows\SysWOW64\nslookup.exe
  nslookup emsisoft.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2020
- C:\Windows\SysWOW64\nslookup.exe
  nslookup esetnod32.bit a.dnspod.com
  2⤵
  PID:932
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit a.dnspod.com
  2⤵
  PID:1796
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1084
- C:\Windows\SysWOW64\nslookup.exe
  nslookup bleepingcomputer.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2320
- C:\Windows\SysWOW64\nslookup.exe
  nslookup emsisoft.bit a.dnspod.com
  2⤵
  PID:1352
- C:\Windows\SysWOW64\nslookup.exe
  nslookup esetnod32.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1984
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1228
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2100
- C:\Windows\SysWOW64\nslookup.exe
  nslookup bleepingcomputer.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2732
- C:\Windows\SysWOW64\nslookup.exe
  nslookup emsisoft.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2592
- C:\Windows\SysWOW64\nslookup.exe
  nslookup esetnod32.bit a.dnspod.com
  2⤵
  PID:2776
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit a.dnspod.com
  2⤵
  PID:2796
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit a.dnspod.com
  2⤵
  PID:484
- C:\Windows\SysWOW64\nslookup.exe
  nslookup bleepingcomputer.bit a.dnspod.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2120
- C:\Windows\SysWOW64\nslookup.exe
  nslookup emsisoft.bit a.dnspod.com
  2⤵
  PID:2124
- C:\Windows\SysWOW64\nslookup.exe
  nslookup esetnod32.bit a.dnspod.com
  2⤵
  PID:2532
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit a.dnspod.com
  2⤵
  PID:2760
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit a.dnspod.com
  2⤵
  PID:3004
- C:\Windows\SysWOW64\nslookup.exe
  nslookup bleepingcomputer.bit a.dnspod.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2400
- C:\Windows\SysWOW64\nslookup.exe
  nslookup emsisoft.bit a.dnspod.com
  2⤵
  PID:2052
- C:\Windows\SysWOW64\nslookup.exe
  nslookup esetnod32.bit a.dnspod.com
  2⤵
  PID:2188
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit a.dnspod.com
  2⤵
  PID:2388
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1500
- C:\Windows\SysWOW64\nslookup.exe
  nslookup bleepingcomputer.bit a.dnspod.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2576
- C:\Windows\SysWOW64\nslookup.exe
  nslookup emsisoft.bit a.dnspod.com
  2⤵
  PID:2148
- C:\Windows\SysWOW64\nslookup.exe
  nslookup esetnod32.bit a.dnspod.com
  2⤵
  PID:1748
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1980
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit a.dnspod.com
  2⤵
  PID:300
- C:\Windows\SysWOW64\nslookup.exe
  nslookup bleepingcomputer.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2888
- C:\Windows\SysWOW64\nslookup.exe
  nslookup emsisoft.bit a.dnspod.com
  2⤵
  PID:2676
- C:\Windows\SysWOW64\nslookup.exe
  nslookup esetnod32.bit a.dnspod.com
  2⤵
  PID:2784
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit a.dnspod.com
  2⤵
  PID:1616
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2416
- C:\Windows\SysWOW64\nslookup.exe
  nslookup bleepingcomputer.bit a.dnspod.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1992
- C:\Windows\SysWOW64\nslookup.exe
  nslookup emsisoft.bit a.dnspod.com
  2⤵
  PID:2984
- C:\Windows\SysWOW64\nslookup.exe
  nslookup esetnod32.bit a.dnspod.com
  2⤵
  PID:344
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1856
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit a.dnspod.com
  2⤵
  PID:3000
- C:\Windows\SysWOW64\nslookup.exe
  nslookup bleepingcomputer.bit a.dnspod.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2608
- C:\Windows\SysWOW64\nslookup.exe
  nslookup emsisoft.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2496
- C:\Windows\SysWOW64\nslookup.exe
  nslookup esetnod32.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2072
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit a.dnspod.com
  2⤵
  PID:1324
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit a.dnspod.com
  2⤵
  PID:2068
- C:\Windows\SysWOW64\nslookup.exe
  nslookup bleepingcomputer.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1968
- C:\Windows\SysWOW64\nslookup.exe
  nslookup emsisoft.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2448
- C:\Windows\SysWOW64\nslookup.exe
  nslookup esetnod32.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:576
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit a.dnspod.com
  2⤵
  PID:1844
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2036
- C:\Windows\SysWOW64\nslookup.exe
  nslookup bleepingcomputer.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2684
- C:\Windows\SysWOW64\nslookup.exe
  nslookup emsisoft.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2800
- C:\Windows\SysWOW64\nslookup.exe
  nslookup esetnod32.bit a.dnspod.com
  2⤵
  PID:296
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:836
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit a.dnspod.com
  2⤵
  PID:1288
- C:\Windows\SysWOW64\nslookup.exe
  nslookup bleepingcomputer.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1704
- C:\Windows\SysWOW64\nslookup.exe
  nslookup emsisoft.bit a.dnspod.com
  2⤵
  PID:1792
- C:\Windows\SysWOW64\nslookup.exe
  nslookup esetnod32.bit a.dnspod.com
  2⤵
  PID:736
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit a.dnspod.com
  2⤵
  PID:1112
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit a.dnspod.com
  2⤵
  PID:928
- C:\Windows\SysWOW64\nslookup.exe
  nslookup bleepingcomputer.bit a.dnspod.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1652
- C:\Windows\SysWOW64\nslookup.exe
  nslookup emsisoft.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2740
- C:\Windows\SysWOW64\nslookup.exe
  nslookup esetnod32.bit a.dnspod.com
  2⤵
  PID:1764
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit a.dnspod.com
  2⤵
  PID:184
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit a.dnspod.com
  2⤵
  PID:1648
- C:\Windows\SysWOW64\nslookup.exe
  nslookup bleepingcomputer.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2564
- C:\Windows\SysWOW64\nslookup.exe
  nslookup emsisoft.bit a.dnspod.com
  2⤵
  PID:848
- C:\Windows\SysWOW64\nslookup.exe
  nslookup esetnod32.bit a.dnspod.com
  2⤵
  PID:2240
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2892
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2116
- C:\Windows\SysWOW64\nslookup.exe
  nslookup bleepingcomputer.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1568
- C:\Windows\SysWOW64\nslookup.exe
  nslookup emsisoft.bit a.dnspod.com
  2⤵
  PID:632
- C:\Windows\SysWOW64\nslookup.exe
  nslookup esetnod32.bit a.dnspod.com
  2⤵
  PID:572
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2912
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit a.dnspod.com
  2⤵
  PID:1052
- C:\Windows\SysWOW64\nslookup.exe
  nslookup bleepingcomputer.bit a.dnspod.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2944
- C:\Windows\SysWOW64\nslookup.exe
  nslookup emsisoft.bit a.dnspod.com
  2⤵
  PID:2196
- C:\Windows\SysWOW64\nslookup.exe
  nslookup esetnod32.bit a.dnspod.com
  2⤵
  PID:1868
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit a.dnspod.com
  2⤵
  PID:1924
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit a.dnspod.com
  2⤵
  PID:2312
- C:\Windows\SysWOW64\nslookup.exe
  nslookup bleepingcomputer.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1552
- C:\Windows\SysWOW64\nslookup.exe
  nslookup emsisoft.bit a.dnspod.com
  2⤵
  PID:1132
- C:\Windows\SysWOW64\nslookup.exe
  nslookup esetnod32.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1380
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit a.dnspod.com
  2⤵
  PID:1996
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit a.dnspod.com
  2⤵
  PID:1280
- C:\Windows\SysWOW64\nslookup.exe
  nslookup bleepingcomputer.bit a.dnspod.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3048
- C:\Windows\SysWOW64\nslookup.exe
  nslookup emsisoft.bit a.dnspod.com
  2⤵
  PID:2584
- C:\Windows\SysWOW64\nslookup.exe
  nslookup esetnod32.bit a.dnspod.com
  2⤵
  PID:2640
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1032
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1048
- C:\Windows\SysWOW64\nslookup.exe
  nslookup bleepingcomputer.bit a.dnspod.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:696
- C:\Windows\SysWOW64\nslookup.exe
  nslookup emsisoft.bit a.dnspod.com
  2⤵
  PID:2988
- C:\Windows\SysWOW64\nslookup.exe
  nslookup esetnod32.bit a.dnspod.com
  2⤵
  PID:2824
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit a.dnspod.com
  2⤵
  PID:2612
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1776
- C:\Windows\SysWOW64\nslookup.exe
  nslookup bleepingcomputer.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:968
- C:\Windows\SysWOW64\nslookup.exe
  nslookup emsisoft.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:604
- C:\Windows\SysWOW64\nslookup.exe
  nslookup esetnod32.bit a.dnspod.com
  2⤵
  PID:2392
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit a.dnspod.com
  2⤵
  PID:2708
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1736
- C:\Windows\SysWOW64\nslookup.exe
  nslookup bleepingcomputer.bit a.dnspod.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:868
- C:\Windows\SysWOW64\nslookup.exe
  nslookup emsisoft.bit a.dnspod.com
  2⤵
  PID:2368
- C:\Windows\SysWOW64\nslookup.exe
  nslookup esetnod32.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2272
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit a.dnspod.com
  2⤵
  PID:2624
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2288
- C:\Windows\SysWOW64\nslookup.exe
  nslookup bleepingcomputer.bit a.dnspod.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2164
- C:\Windows\SysWOW64\nslookup.exe
  nslookup emsisoft.bit a.dnspod.com
  2⤵
  PID:1580
- C:\Windows\SysWOW64\nslookup.exe
  nslookup esetnod32.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1524
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit a.dnspod.com
  2⤵
  PID:2948
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit a.dnspod.com
  2⤵
  PID:2292
- C:\Windows\SysWOW64\nslookup.exe
  nslookup bleepingcomputer.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2208
- C:\Windows\SysWOW64\nslookup.exe
  nslookup emsisoft.bit a.dnspod.com
  2⤵
  PID:2724
- C:\Windows\SysWOW64\nslookup.exe
  nslookup esetnod32.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1484
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit a.dnspod.com
  2⤵
  PID:1108
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1572
- C:\Windows\SysWOW64\nslookup.exe
  nslookup bleepingcomputer.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:908
- C:\Windows\SysWOW64\nslookup.exe
  nslookup emsisoft.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1528
- C:\Windows\SysWOW64\nslookup.exe
  nslookup esetnod32.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2492
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2744
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2660
- C:\Windows\SysWOW64\nslookup.exe
  nslookup bleepingcomputer.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3052
- C:\Windows\SysWOW64\nslookup.exe
  nslookup emsisoft.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2356
- C:\Windows\SysWOW64\nslookup.exe
  nslookup esetnod32.bit a.dnspod.com
  2⤵
  PID:2268
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1360
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit a.dnspod.com
  2⤵
  PID:2696
- C:\Windows\SysWOW64\nslookup.exe
  nslookup bleepingcomputer.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1384
- C:\Windows\SysWOW64\nslookup.exe
  nslookup emsisoft.bit a.dnspod.com
  2⤵
  PID:1808
- C:\Windows\SysWOW64\nslookup.exe
  nslookup esetnod32.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2500
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit a.dnspod.com
  2⤵
  PID:2920
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit a.dnspod.com
  2⤵
  PID:760
- C:\Windows\SysWOW64\nslookup.exe
  nslookup bleepingcomputer.bit a.dnspod.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1308
- C:\Windows\SysWOW64\nslookup.exe
  nslookup emsisoft.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1768
- C:\Windows\SysWOW64\nslookup.exe
  nslookup esetnod32.bit a.dnspod.com
  2⤵
  PID:2852
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit a.dnspod.com
  2⤵
  PID:2820
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit a.dnspod.com
  2⤵
  - System Location Discovery: System Language Discovery
  PID:772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2844-1-0x0000000000300000-0x0000000000400000-memory.dmp

Filesize
1024KB

Download
memory/2844-2-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2844-4-0x0000000000300000-0x0000000000400000-memory.dmp

Filesize
1024KB

Download
memory/2844-5-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-6-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2844-7-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-8-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-9-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-10-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-12-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-13-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-14-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-15-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-16-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-17-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-18-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-19-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-20-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-22-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-23-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-24-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-25-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-26-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-27-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-28-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-29-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-30-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-32-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-33-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-34-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-35-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-36-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-37-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-38-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-40-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-41-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-42-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-43-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-44-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-45-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-46-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-48-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-49-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-50-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-51-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-52-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-53-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-54-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-55-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-56-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-58-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-59-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-60-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-61-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-62-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-63-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-64-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-65-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-66-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-68-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2844-69-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download