Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

2024-11-16...ab.exe

windows7-x64

6

2024-11-16...ab.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    22s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/11/2024, 09:03 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-11-16_87a857db50d220828e70f4e5ba6cf49f_gandcrab.exe

  • Size

    73KB

  • MD5

    87a857db50d220828e70f4e5ba6cf49f

  • SHA1

    bf596087b6f9aab79447c8f106a91295ad941c42

  • SHA256

    16aa236a93c2aad275da468b5e1066bbb96701c211e698a23f31e5d9faab2df0

  • SHA512

    e04490f34695faab52668d5a49984be39356cc9c602bc847ee0c99c8c256af8f13d17b156ee33edd9022f8c35c590a420f2e2c1ba6d43cb7f57efc543d1e36d3

  • SSDEEP

    1536:v55u555555555pmgSeGDjtQhnwmmB0ybMqqU+2bbbAV2/S2mr3IdE8mne0Avu5rJ:bMSjOnrmBTMqqDL2/mr3IdE8we0Avu5F

Score
6/10
discoverypersistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-11-16_87a857db50d220828e70f4e5ba6cf49f_gandcrab.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-11-16_87a857db50d220828e70f4e5ba6cf49f_gandcrab.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1984
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.bit dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4316
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup emsisoft.bit dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1120
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup gandcrab.bit dns1.soprodns.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4832
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.bit dns1.soprodns.ru
      2⤵
        PID:1564
      • C:\Windows\SysWOW64\nslookup.exe
        nslookup emsisoft.bit dns1.soprodns.ru
        2⤵
          PID:1848
        • C:\Windows\SysWOW64\nslookup.exe
          nslookup gandcrab.bit dns1.soprodns.ru
          2⤵
            PID:636
          • C:\Windows\SysWOW64\nslookup.exe
            nslookup nomoreransom.bit dns1.soprodns.ru
            2⤵
              PID:2716
            • C:\Windows\SysWOW64\nslookup.exe
              nslookup emsisoft.bit dns1.soprodns.ru
              2⤵
                PID:3020
              • C:\Windows\SysWOW64\nslookup.exe
                nslookup gandcrab.bit dns1.soprodns.ru
                2⤵
                  PID:4664
                • C:\Windows\SysWOW64\nslookup.exe
                  nslookup nomoreransom.bit dns1.soprodns.ru
                  2⤵
                    PID:2552
                  • C:\Windows\SysWOW64\nslookup.exe
                    nslookup emsisoft.bit dns1.soprodns.ru
                    2⤵
                      PID:1588
                    • C:\Windows\SysWOW64\nslookup.exe
                      nslookup gandcrab.bit dns1.soprodns.ru
                      2⤵
                        PID:1792
                      • C:\Windows\SysWOW64\nslookup.exe
                        nslookup nomoreransom.bit dns1.soprodns.ru
                        2⤵
                          PID:3896
                        • C:\Windows\SysWOW64\nslookup.exe
                          nslookup emsisoft.bit dns1.soprodns.ru
                          2⤵
                            PID:332
                          • C:\Windows\SysWOW64\nslookup.exe
                            nslookup gandcrab.bit dns1.soprodns.ru
                            2⤵
                              PID:4192

                          Network

                          • flag-us
                            DNS
                            154.239.44.20.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            154.239.44.20.in-addr.arpa
                            IN PTR
                            Response
                          • flag-us
                            DNS
                            ipv4bot.whatismyipaddress.com
                            2024-11-16_87a857db50d220828e70f4e5ba6cf49f_gandcrab.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            ipv4bot.whatismyipaddress.com
                            IN A
                            Response
                          • flag-us
                            DNS
                            dns1.soprodns.ru
                            nslookup.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            dns1.soprodns.ru
                            IN A
                            Response
                          • flag-us
                            DNS
                            8.8.8.8.in-addr.arpa
                            nslookup.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            8.8.8.8.in-addr.arpa
                            IN PTR
                            Response
                            8.8.8.8.in-addr.arpa
                            IN PTR
                            dnsgoogle
                          • flag-us
                            DNS
                            nomoreransom.bit
                            nslookup.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            nomoreransom.bit
                            IN A
                            Response
                          • flag-us
                            DNS
                            nomoreransom.bit
                            nslookup.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            nomoreransom.bit
                            IN AAAA
                            Response
                          • flag-us
                            DNS
                            nomoreransom.bit
                            nslookup.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            nomoreransom.bit
                            IN A
                            Response
                          • flag-us
                            DNS
                            nomoreransom.bit
                            nslookup.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            nomoreransom.bit
                            IN AAAA
                            Response
                          • flag-us
                            DNS
                            2.159.190.20.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            2.159.190.20.in-addr.arpa
                            IN PTR
                            Response
                          • flag-us
                            DNS
                            95.221.229.192.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            95.221.229.192.in-addr.arpa
                            IN PTR
                            Response
                          • flag-us
                            DNS
                            dns1.soprodns.ru
                            nslookup.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            dns1.soprodns.ru
                            IN A
                            Response
                          • flag-us
                            DNS
                            8.8.8.8.in-addr.arpa
                            nslookup.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            8.8.8.8.in-addr.arpa
                            IN PTR
                            Response
                            8.8.8.8.in-addr.arpa
                            IN PTR
                            dnsgoogle
                          • flag-us
                            DNS
                            emsisoft.bit
                            nslookup.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            emsisoft.bit
                            IN A
                            Response
                          • flag-us
                            DNS
                            58.55.71.13.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            58.55.71.13.in-addr.arpa
                            IN PTR
                            Response
                          • flag-us
                            DNS
                            emsisoft.bit
                            nslookup.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            emsisoft.bit
                            IN AAAA
                            Response
                          • flag-us
                            DNS
                            emsisoft.bit
                            nslookup.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            emsisoft.bit
                            IN A
                            Response
                          • flag-us
                            DNS
                            emsisoft.bit
                            nslookup.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            emsisoft.bit
                            IN AAAA
                            Response
                          • flag-us
                            DNS
                            dns1.soprodns.ru
                            nslookup.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            dns1.soprodns.ru
                            IN A
                            Response
                          • flag-us
                            DNS
                            8.8.8.8.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            8.8.8.8.in-addr.arpa
                            IN PTR
                            Response
                            8.8.8.8.in-addr.arpa
                            IN PTR
                            dnsgoogle
                          • flag-us
                            DNS
                            gandcrab.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            gandcrab.bit
                            IN A
                            Response
                          • flag-us
                            DNS
                            gandcrab.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            gandcrab.bit
                            IN AAAA
                            Response
                          • flag-us
                            DNS
                            gandcrab.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            gandcrab.bit
                            IN A
                            Response
                          • flag-us
                            DNS
                            gandcrab.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            gandcrab.bit
                            IN AAAA
                            Response
                          • flag-us
                            DNS
                            56.163.245.4.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            56.163.245.4.in-addr.arpa
                            IN PTR
                            Response
                          • flag-us
                            DNS
                            171.39.242.20.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            171.39.242.20.in-addr.arpa
                            IN PTR
                            Response
                          • flag-us
                            DNS
                            dns1.soprodns.ru
                            nslookup.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            dns1.soprodns.ru
                            IN A
                            Response
                          • flag-us
                            DNS
                            8.8.8.8.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            8.8.8.8.in-addr.arpa
                            IN PTR
                            Response
                            8.8.8.8.in-addr.arpa
                            IN PTR
                            dnsgoogle
                          • flag-us
                            DNS
                            nomoreransom.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            nomoreransom.bit
                            IN A
                            Response
                          • flag-us
                            DNS
                            nomoreransom.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            nomoreransom.bit
                            IN AAAA
                            Response
                          • flag-us
                            DNS
                            nomoreransom.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            nomoreransom.bit
                            IN A
                            Response
                          • flag-us
                            DNS
                            nomoreransom.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            nomoreransom.bit
                            IN AAAA
                            Response
                          • flag-us
                            DNS
                            172.214.232.199.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            172.214.232.199.in-addr.arpa
                            IN PTR
                            Response
                          • flag-us
                            DNS
                            dns1.soprodns.ru
                            nslookup.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            dns1.soprodns.ru
                            IN A
                            Response
                          • flag-us
                            DNS
                            8.8.8.8.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            8.8.8.8.in-addr.arpa
                            IN PTR
                            Response
                            8.8.8.8.in-addr.arpa
                            IN PTR
                            dnsgoogle
                          • flag-us
                            DNS
                            emsisoft.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            emsisoft.bit
                            IN A
                            Response
                          • flag-us
                            DNS
                            emsisoft.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            emsisoft.bit
                            IN AAAA
                            Response
                          • flag-us
                            DNS
                            emsisoft.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            emsisoft.bit
                            IN A
                            Response
                          • flag-us
                            DNS
                            emsisoft.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            emsisoft.bit
                            IN AAAA
                            Response
                          • flag-us
                            DNS
                            dns1.soprodns.ru
                            nslookup.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            dns1.soprodns.ru
                            IN A
                            Response
                          • flag-us
                            DNS
                            8.8.8.8.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            8.8.8.8.in-addr.arpa
                            IN PTR
                            Response
                            8.8.8.8.in-addr.arpa
                            IN PTR
                            dnsgoogle
                          • flag-us
                            DNS
                            gandcrab.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            gandcrab.bit
                            IN A
                            Response
                          • flag-us
                            DNS
                            gandcrab.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            gandcrab.bit
                            IN AAAA
                            Response
                          • flag-us
                            DNS
                            gandcrab.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            gandcrab.bit
                            IN A
                            Response
                          • flag-us
                            DNS
                            gandcrab.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            gandcrab.bit
                            IN AAAA
                            Response
                          • flag-us
                            DNS
                            83.210.23.2.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            83.210.23.2.in-addr.arpa
                            IN PTR
                            Response
                            83.210.23.2.in-addr.arpa
                            IN PTR
                            a2-23-210-83deploystaticakamaitechnologiescom
                          • flag-us
                            DNS
                            dns1.soprodns.ru
                            nslookup.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            dns1.soprodns.ru
                            IN A
                            Response
                          • flag-us
                            DNS
                            8.8.8.8.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            8.8.8.8.in-addr.arpa
                            IN PTR
                            Response
                            8.8.8.8.in-addr.arpa
                            IN PTR
                            dnsgoogle
                          • flag-us
                            DNS
                            nomoreransom.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            nomoreransom.bit
                            IN A
                            Response
                          • flag-us
                            DNS
                            nomoreransom.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            nomoreransom.bit
                            IN AAAA
                            Response
                          • flag-us
                            DNS
                            nomoreransom.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            nomoreransom.bit
                            IN A
                            Response
                          • flag-us
                            DNS
                            nomoreransom.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            nomoreransom.bit
                            IN AAAA
                            Response
                          • flag-us
                            DNS
                            dns1.soprodns.ru
                            nslookup.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            dns1.soprodns.ru
                            IN A
                            Response
                          • flag-us
                            DNS
                            8.8.8.8.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            8.8.8.8.in-addr.arpa
                            IN PTR
                            Response
                            8.8.8.8.in-addr.arpa
                            IN PTR
                            dnsgoogle
                          • flag-us
                            DNS
                            emsisoft.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            emsisoft.bit
                            IN A
                            Response
                          • flag-us
                            DNS
                            emsisoft.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            emsisoft.bit
                            IN AAAA
                            Response
                          • flag-us
                            DNS
                            emsisoft.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            emsisoft.bit
                            IN A
                            Response
                          • flag-us
                            DNS
                            emsisoft.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            emsisoft.bit
                            IN AAAA
                            Response
                          • flag-us
                            DNS
                            dns1.soprodns.ru
                            nslookup.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            dns1.soprodns.ru
                            IN A
                            Response
                          • flag-us
                            DNS
                            8.8.8.8.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            8.8.8.8.in-addr.arpa
                            IN PTR
                            Response
                            8.8.8.8.in-addr.arpa
                            IN PTR
                            dnsgoogle
                          • flag-us
                            DNS
                            gandcrab.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            gandcrab.bit
                            IN A
                            Response
                          • flag-us
                            DNS
                            gandcrab.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            gandcrab.bit
                            IN AAAA
                            Response
                          • flag-us
                            DNS
                            gandcrab.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            gandcrab.bit
                            IN A
                            Response
                          • flag-us
                            DNS
                            gandcrab.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            gandcrab.bit
                            IN AAAA
                            Response
                          • flag-us
                            DNS
                            43.229.111.52.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            43.229.111.52.in-addr.arpa
                            IN PTR
                            Response
                          • flag-us
                            DNS
                            dns1.soprodns.ru
                            nslookup.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            dns1.soprodns.ru
                            IN A
                            Response
                          • flag-us
                            DNS
                            8.8.8.8.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            8.8.8.8.in-addr.arpa
                            IN PTR
                            Response
                            8.8.8.8.in-addr.arpa
                            IN PTR
                            dnsgoogle
                          • flag-us
                            DNS
                            nomoreransom.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            nomoreransom.bit
                            IN A
                            Response
                          • flag-us
                            DNS
                            nomoreransom.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            nomoreransom.bit
                            IN AAAA
                            Response
                          • flag-us
                            DNS
                            nomoreransom.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            nomoreransom.bit
                            IN A
                            Response
                          • flag-us
                            DNS
                            nomoreransom.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            nomoreransom.bit
                            IN AAAA
                            Response
                          • flag-us
                            DNS
                            dns1.soprodns.ru
                            nslookup.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            dns1.soprodns.ru
                            IN A
                            Response
                          • flag-us
                            DNS
                            8.8.8.8.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            8.8.8.8.in-addr.arpa
                            IN PTR
                            Response
                            8.8.8.8.in-addr.arpa
                            IN PTR
                            dnsgoogle
                          • flag-us
                            DNS
                            emsisoft.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            emsisoft.bit
                            IN A
                            Response
                          • flag-us
                            DNS
                            emsisoft.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            emsisoft.bit
                            IN AAAA
                            Response
                          • flag-us
                            DNS
                            emsisoft.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            emsisoft.bit
                            IN A
                            Response
                          • flag-us
                            DNS
                            emsisoft.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            emsisoft.bit
                            IN AAAA
                            Response
                          • flag-us
                            DNS
                            dns1.soprodns.ru
                            nslookup.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            dns1.soprodns.ru
                            IN A
                            Response
                          • flag-us
                            DNS
                            8.8.8.8.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            8.8.8.8.in-addr.arpa
                            IN PTR
                            Response
                            8.8.8.8.in-addr.arpa
                            IN PTR
                            dnsgoogle
                          • flag-us
                            DNS
                            gandcrab.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            gandcrab.bit
                            IN A
                            Response
                          • flag-us
                            DNS
                            gandcrab.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            gandcrab.bit
                            IN AAAA
                            Response
                          • flag-us
                            DNS
                            gandcrab.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            gandcrab.bit
                            IN A
                            Response
                          • flag-us
                            DNS
                            gandcrab.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            gandcrab.bit
                            IN AAAA
                            Response
                          • flag-us
                            DNS
                            dns1.soprodns.ru
                            nslookup.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            dns1.soprodns.ru
                            IN A
                            Response
                          • flag-us
                            DNS
                            8.8.8.8.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            8.8.8.8.in-addr.arpa
                            IN PTR
                            Response
                            8.8.8.8.in-addr.arpa
                            IN PTR
                            dnsgoogle
                          • flag-us
                            DNS
                            nomoreransom.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            nomoreransom.bit
                            IN A
                            Response
                          • flag-us
                            DNS
                            nomoreransom.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            nomoreransom.bit
                            IN AAAA
                            Response
                          • flag-us
                            DNS
                            nomoreransom.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            nomoreransom.bit
                            IN A
                            Response
                          • flag-us
                            DNS
                            nomoreransom.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            nomoreransom.bit
                            IN AAAA
                            Response
                          • flag-us
                            DNS
                            dns1.soprodns.ru
                            nslookup.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            dns1.soprodns.ru
                            IN A
                            Response
                          • flag-us
                            DNS
                            8.8.8.8.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            8.8.8.8.in-addr.arpa
                            IN PTR
                            Response
                            8.8.8.8.in-addr.arpa
                            IN PTR
                            dnsgoogle
                          • flag-us
                            DNS
                            emsisoft.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            emsisoft.bit
                            IN A
                            Response
                          • flag-us
                            DNS
                            emsisoft.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            emsisoft.bit
                            IN AAAA
                            Response
                          • flag-us
                            DNS
                            emsisoft.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            emsisoft.bit
                            IN A
                            Response
                          • flag-us
                            DNS
                            emsisoft.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            emsisoft.bit
                            IN AAAA
                            Response
                          • flag-us
                            DNS
                            dns1.soprodns.ru
                            nslookup.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            dns1.soprodns.ru
                            IN A
                            Response
                          • flag-us
                            DNS
                            8.8.8.8.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            8.8.8.8.in-addr.arpa
                            IN PTR
                            Response
                            8.8.8.8.in-addr.arpa
                            IN PTR
                            dnsgoogle
                          • flag-us
                            DNS
                            gandcrab.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            gandcrab.bit
                            IN A
                            Response
                          • flag-us
                            DNS
                            gandcrab.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            gandcrab.bit
                            IN AAAA
                            Response
                          • flag-us
                            DNS
                            gandcrab.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            gandcrab.bit
                            IN A
                            Response
                          • flag-us
                            DNS
                            gandcrab.bit
                            Remote address:
                            8.8.8.8:53
                            Request
                            gandcrab.bit
                            IN AAAA
                            Response
                          • flag-us
                            DNS
                            28.73.42.20.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            28.73.42.20.in-addr.arpa
                            IN PTR
                            Response
                          No results found
                          • 8.8.8.8:53
                            154.239.44.20.in-addr.arpa
                            dns
                            72 B
                             158 B
                             1
                            1

                            DNS Request

                            154.239.44.20.in-addr.arpa

                          • 8.8.8.8:53
                            ipv4bot.whatismyipaddress.com
                            dns
                            2024-11-16_87a857db50d220828e70f4e5ba6cf49f_gandcrab.exe
                            75 B
                             134 B
                             1
                            1

                            DNS Request

                            ipv4bot.whatismyipaddress.com

                          • 8.8.8.8:53
                            dns1.soprodns.ru
                            dns
                            nslookup.exe
                            62 B
                             123 B
                             1
                            1

                            DNS Request

                            dns1.soprodns.ru

                          • 8.8.8.8:53
                            8.8.8.8.in-addr.arpa
                            dns
                            nslookup.exe
                            66 B
                             90 B
                             1
                            1

                            DNS Request

                            8.8.8.8.in-addr.arpa

                          • 8.8.8.8:53
                            nomoreransom.bit
                            dns
                            nslookup.exe
                            62 B
                             137 B
                             1
                            1

                            DNS Request

                            nomoreransom.bit

                          • 8.8.8.8:53
                            nomoreransom.bit
                            dns
                            nslookup.exe
                            62 B
                             137 B
                             1
                            1

                            DNS Request

                            nomoreransom.bit

                          • 8.8.8.8:53
                            nomoreransom.bit
                            dns
                            nslookup.exe
                            62 B
                             137 B
                             1
                            1

                            DNS Request

                            nomoreransom.bit

                          • 8.8.8.8:53
                            nomoreransom.bit
                            dns
                            nslookup.exe
                            62 B
                             137 B
                             1
                            1

                            DNS Request

                            nomoreransom.bit

                          • 8.8.8.8:53
                            2.159.190.20.in-addr.arpa
                            dns
                            71 B
                             157 B
                             1
                            1

                            DNS Request

                            2.159.190.20.in-addr.arpa

                          • 8.8.8.8:53
                            95.221.229.192.in-addr.arpa
                            dns
                            73 B
                             144 B
                             1
                            1

                            DNS Request

                            95.221.229.192.in-addr.arpa

                          • 8.8.8.8:53
                            dns1.soprodns.ru
                            dns
                            nslookup.exe
                            62 B
                             123 B
                             1
                            1

                            DNS Request

                            dns1.soprodns.ru

                          • 8.8.8.8:53
                            8.8.8.8.in-addr.arpa
                            dns
                            nslookup.exe
                            66 B
                             90 B
                             1
                            1

                            DNS Request

                            8.8.8.8.in-addr.arpa

                          • 8.8.8.8:53
                            emsisoft.bit
                            dns
                            nslookup.exe
                            58 B
                             133 B
                             1
                            1

                            DNS Request

                            emsisoft.bit

                          • 8.8.8.8:53
                            58.55.71.13.in-addr.arpa
                            dns
                            70 B
                             144 B
                             1
                            1

                            DNS Request

                            58.55.71.13.in-addr.arpa

                          • 8.8.8.8:53
                            emsisoft.bit
                            dns
                            nslookup.exe
                            58 B
                             133 B
                             1
                            1

                            DNS Request

                            emsisoft.bit

                          • 8.8.8.8:53
                            emsisoft.bit
                            dns
                            nslookup.exe
                            58 B
                             133 B
                             1
                            1

                            DNS Request

                            emsisoft.bit

                          • 8.8.8.8:53
                            emsisoft.bit
                            dns
                            nslookup.exe
                            58 B
                             133 B
                             1
                            1

                            DNS Request

                            emsisoft.bit

                          • 8.8.8.8:53
                            dns1.soprodns.ru
                            dns
                            nslookup.exe
                            62 B
                             123 B
                             1
                            1

                            DNS Request

                            dns1.soprodns.ru

                          • 8.8.8.8:53
                            8.8.8.8.in-addr.arpa
                            dns
                            66 B
                             90 B
                             1
                            1

                            DNS Request

                            8.8.8.8.in-addr.arpa

                          • 8.8.8.8:53
                            gandcrab.bit
                            dns
                            58 B
                             133 B
                             1
                            1

                            DNS Request

                            gandcrab.bit

                          • 8.8.8.8:53
                            gandcrab.bit
                            dns
                            58 B
                             133 B
                             1
                            1

                            DNS Request

                            gandcrab.bit

                          • 8.8.8.8:53
                            gandcrab.bit
                            dns
                            58 B
                             133 B
                             1
                            1

                            DNS Request

                            gandcrab.bit

                          • 8.8.8.8:53
                            gandcrab.bit
                            dns
                            58 B
                             133 B
                             1
                            1

                            DNS Request

                            gandcrab.bit

                          • 8.8.8.8:53
                            56.163.245.4.in-addr.arpa
                            dns
                            71 B
                             157 B
                             1
                            1

                            DNS Request

                            56.163.245.4.in-addr.arpa

                          • 8.8.8.8:53
                            171.39.242.20.in-addr.arpa
                            dns
                            72 B
                             158 B
                             1
                            1

                            DNS Request

                            171.39.242.20.in-addr.arpa

                          • 8.8.8.8:53
                            dns1.soprodns.ru
                            dns
                            nslookup.exe
                            62 B
                             123 B
                             1
                            1

                            DNS Request

                            dns1.soprodns.ru

                          • 8.8.8.8:53
                            8.8.8.8.in-addr.arpa
                            dns
                            66 B
                             90 B
                             1
                            1

                            DNS Request

                            8.8.8.8.in-addr.arpa

                          • 8.8.8.8:53
                            nomoreransom.bit
                            dns
                            62 B
                             137 B
                             1
                            1

                            DNS Request

                            nomoreransom.bit

                          • 8.8.8.8:53
                            nomoreransom.bit
                            dns
                            62 B
                             137 B
                             1
                            1

                            DNS Request

                            nomoreransom.bit

                          • 8.8.8.8:53
                            nomoreransom.bit
                            dns
                            62 B
                             137 B
                             1
                            1

                            DNS Request

                            nomoreransom.bit

                          • 8.8.8.8:53
                            nomoreransom.bit
                            dns
                            62 B
                             137 B
                             1
                            1

                            DNS Request

                            nomoreransom.bit

                          • 8.8.8.8:53
                            172.214.232.199.in-addr.arpa
                            dns
                            74 B
                             128 B
                             1
                            1

                            DNS Request

                            172.214.232.199.in-addr.arpa

                          • 8.8.8.8:53
                            dns1.soprodns.ru
                            dns
                            nslookup.exe
                            62 B
                             123 B
                             1
                            1

                            DNS Request

                            dns1.soprodns.ru

                          • 8.8.8.8:53
                            8.8.8.8.in-addr.arpa
                            dns
                            66 B
                             90 B
                             1
                            1

                            DNS Request

                            8.8.8.8.in-addr.arpa

                          • 8.8.8.8:53
                            emsisoft.bit
                            dns
                            58 B
                             133 B
                             1
                            1

                            DNS Request

                            emsisoft.bit

                          • 8.8.8.8:53
                            emsisoft.bit
                            dns
                            58 B
                             133 B
                             1
                            1

                            DNS Request

                            emsisoft.bit

                          • 8.8.8.8:53
                            emsisoft.bit
                            dns
                            58 B
                             133 B
                             1
                            1

                            DNS Request

                            emsisoft.bit

                          • 8.8.8.8:53
                            emsisoft.bit
                            dns
                            58 B
                             133 B
                             1
                            1

                            DNS Request

                            emsisoft.bit

                          • 8.8.8.8:53
                            dns1.soprodns.ru
                            dns
                            nslookup.exe
                            62 B
                             123 B
                             1
                            1

                            DNS Request

                            dns1.soprodns.ru

                          • 8.8.8.8:53
                            8.8.8.8.in-addr.arpa
                            dns
                            66 B
                             90 B
                             1
                            1

                            DNS Request

                            8.8.8.8.in-addr.arpa

                          • 8.8.8.8:53
                            gandcrab.bit
                            dns
                            58 B
                             133 B
                             1
                            1

                            DNS Request

                            gandcrab.bit

                          • 8.8.8.8:53
                            gandcrab.bit
                            dns
                            58 B
                             133 B
                             1
                            1

                            DNS Request

                            gandcrab.bit

                          • 8.8.8.8:53
                            gandcrab.bit
                            dns
                            58 B
                             133 B
                             1
                            1

                            DNS Request

                            gandcrab.bit

                          • 8.8.8.8:53
                            gandcrab.bit
                            dns
                            58 B
                             133 B
                             1
                            1

                            DNS Request

                            gandcrab.bit

                          • 8.8.8.8:53
                            83.210.23.2.in-addr.arpa
                            dns
                            70 B
                             133 B
                             1
                            1

                            DNS Request

                            83.210.23.2.in-addr.arpa

                          • 8.8.8.8:53
                            dns1.soprodns.ru
                            dns
                            nslookup.exe
                            62 B
                             123 B
                             1
                            1

                            DNS Request

                            dns1.soprodns.ru

                          • 8.8.8.8:53
                            8.8.8.8.in-addr.arpa
                            dns
                            66 B
                             90 B
                             1
                            1

                            DNS Request

                            8.8.8.8.in-addr.arpa

                          • 8.8.8.8:53
                            nomoreransom.bit
                            dns
                            62 B
                             137 B
                             1
                            1

                            DNS Request

                            nomoreransom.bit

                          • 8.8.8.8:53
                            nomoreransom.bit
                            dns
                            62 B
                             137 B
                             1
                            1

                            DNS Request

                            nomoreransom.bit

                          • 8.8.8.8:53
                            nomoreransom.bit
                            dns
                            62 B
                             137 B
                             1
                            1

                            DNS Request

                            nomoreransom.bit

                          • 8.8.8.8:53
                            nomoreransom.bit
                            dns
                            62 B
                             137 B
                             1
                            1

                            DNS Request

                            nomoreransom.bit

                          • 8.8.8.8:53
                            dns1.soprodns.ru
                            dns
                            nslookup.exe
                            62 B
                             123 B
                             1
                            1

                            DNS Request

                            dns1.soprodns.ru

                          • 8.8.8.8:53
                            8.8.8.8.in-addr.arpa
                            dns
                            66 B
                             90 B
                             1
                            1

                            DNS Request

                            8.8.8.8.in-addr.arpa

                          • 8.8.8.8:53
                            emsisoft.bit
                            dns
                            58 B
                             133 B
                             1
                            1

                            DNS Request

                            emsisoft.bit

                          • 8.8.8.8:53
                            emsisoft.bit
                            dns
                            58 B
                             133 B
                             1
                            1

                            DNS Request

                            emsisoft.bit

                          • 8.8.8.8:53
                            emsisoft.bit
                            dns
                            58 B
                             133 B
                             1
                            1

                            DNS Request

                            emsisoft.bit

                          • 8.8.8.8:53
                            emsisoft.bit
                            dns
                            58 B
                             133 B
                             1
                            1

                            DNS Request

                            emsisoft.bit

                          • 8.8.8.8:53
                            dns1.soprodns.ru
                            dns
                            nslookup.exe
                            62 B
                             123 B
                             1
                            1

                            DNS Request

                            dns1.soprodns.ru

                          • 8.8.8.8:53
                            8.8.8.8.in-addr.arpa
                            dns
                            66 B
                             90 B
                             1
                            1

                            DNS Request

                            8.8.8.8.in-addr.arpa

                          • 8.8.8.8:53
                            gandcrab.bit
                            dns
                            58 B
                             133 B
                             1
                            1

                            DNS Request

                            gandcrab.bit

                          • 8.8.8.8:53
                            gandcrab.bit
                            dns
                            58 B
                             133 B
                             1
                            1

                            DNS Request

                            gandcrab.bit

                          • 8.8.8.8:53
                            gandcrab.bit
                            dns
                            58 B
                             133 B
                             1
                            1

                            DNS Request

                            gandcrab.bit

                          • 8.8.8.8:53
                            gandcrab.bit
                            dns
                            58 B
                             133 B
                             1
                            1

                            DNS Request

                            gandcrab.bit

                          • 8.8.8.8:53
                            43.229.111.52.in-addr.arpa
                            dns
                            72 B
                             158 B
                             1
                            1

                            DNS Request

                            43.229.111.52.in-addr.arpa

                          • 8.8.8.8:53
                            dns1.soprodns.ru
                            dns
                            nslookup.exe
                            62 B
                             123 B
                             1
                            1

                            DNS Request

                            dns1.soprodns.ru

                          • 8.8.8.8:53
                            8.8.8.8.in-addr.arpa
                            dns
                            66 B
                             90 B
                             1
                            1

                            DNS Request

                            8.8.8.8.in-addr.arpa

                          • 8.8.8.8:53
                            nomoreransom.bit
                            dns
                            62 B
                             137 B
                             1
                            1

                            DNS Request

                            nomoreransom.bit

                          • 8.8.8.8:53
                            nomoreransom.bit
                            dns
                            62 B
                             137 B
                             1
                            1

                            DNS Request

                            nomoreransom.bit

                          • 8.8.8.8:53
                            nomoreransom.bit
                            dns
                            62 B
                             137 B
                             1
                            1

                            DNS Request

                            nomoreransom.bit

                          • 8.8.8.8:53
                            nomoreransom.bit
                            dns
                            62 B
                             137 B
                             1
                            1

                            DNS Request

                            nomoreransom.bit

                          • 8.8.8.8:53
                            dns1.soprodns.ru
                            dns
                            nslookup.exe
                            62 B
                             123 B
                             1
                            1

                            DNS Request

                            dns1.soprodns.ru

                          • 8.8.8.8:53
                            8.8.8.8.in-addr.arpa
                            dns
                            66 B
                             90 B
                             1
                            1

                            DNS Request

                            8.8.8.8.in-addr.arpa

                          • 8.8.8.8:53
                            emsisoft.bit
                            dns
                            58 B
                             133 B
                             1
                            1

                            DNS Request

                            emsisoft.bit

                          • 8.8.8.8:53
                            emsisoft.bit
                            dns
                            58 B
                             133 B
                             1
                            1

                            DNS Request

                            emsisoft.bit

                          • 8.8.8.8:53
                            emsisoft.bit
                            dns
                            58 B
                             133 B
                             1
                            1

                            DNS Request

                            emsisoft.bit

                          • 8.8.8.8:53
                            emsisoft.bit
                            dns
                            58 B
                             133 B
                             1
                            1

                            DNS Request

                            emsisoft.bit

                          • 8.8.8.8:53
                            dns1.soprodns.ru
                            dns
                            nslookup.exe
                            62 B
                             123 B
                             1
                            1

                            DNS Request

                            dns1.soprodns.ru

                          • 8.8.8.8:53
                            8.8.8.8.in-addr.arpa
                            dns
                            66 B
                             90 B
                             1
                            1

                            DNS Request

                            8.8.8.8.in-addr.arpa

                          • 8.8.8.8:53
                            gandcrab.bit
                            dns
                            58 B
                             133 B
                             1
                            1

                            DNS Request

                            gandcrab.bit

                          • 8.8.8.8:53
                            gandcrab.bit
                            dns
                            58 B
                             133 B
                             1
                            1

                            DNS Request

                            gandcrab.bit

                          • 8.8.8.8:53
                            gandcrab.bit
                            dns
                            58 B
                             133 B
                             1
                            1

                            DNS Request

                            gandcrab.bit

                          • 8.8.8.8:53
                            gandcrab.bit
                            dns
                            58 B
                             133 B
                             1
                            1

                            DNS Request

                            gandcrab.bit

                          • 8.8.8.8:53
                            dns1.soprodns.ru
                            dns
                            nslookup.exe
                            62 B
                             123 B
                             1
                            1

                            DNS Request

                            dns1.soprodns.ru

                          • 8.8.8.8:53
                            8.8.8.8.in-addr.arpa
                            dns
                            66 B
                             90 B
                             1
                            1

                            DNS Request

                            8.8.8.8.in-addr.arpa

                          • 8.8.8.8:53
                            nomoreransom.bit
                            dns
                            62 B
                             137 B
                             1
                            1

                            DNS Request

                            nomoreransom.bit

                          • 8.8.8.8:53
                            nomoreransom.bit
                            dns
                            62 B
                             137 B
                             1
                            1

                            DNS Request

                            nomoreransom.bit

                          • 8.8.8.8:53
                            nomoreransom.bit
                            dns
                            62 B
                             137 B
                             1
                            1

                            DNS Request

                            nomoreransom.bit

                          • 8.8.8.8:53
                            nomoreransom.bit
                            dns
                            62 B
                             137 B
                             1
                            1

                            DNS Request

                            nomoreransom.bit

                          • 8.8.8.8:53
                            dns1.soprodns.ru
                            dns
                            nslookup.exe
                            62 B
                             123 B
                             1
                            1

                            DNS Request

                            dns1.soprodns.ru

                          • 8.8.8.8:53
                            8.8.8.8.in-addr.arpa
                            dns
                            66 B
                             90 B
                             1
                            1

                            DNS Request

                            8.8.8.8.in-addr.arpa

                          • 8.8.8.8:53
                            emsisoft.bit
                            dns
                            58 B
                             133 B
                             1
                            1

                            DNS Request

                            emsisoft.bit

                          • 8.8.8.8:53
                            emsisoft.bit
                            dns
                            58 B
                             133 B
                             1
                            1

                            DNS Request

                            emsisoft.bit

                          • 8.8.8.8:53
                            emsisoft.bit
                            dns
                            58 B
                             133 B
                             1
                            1

                            DNS Request

                            emsisoft.bit

                          • 8.8.8.8:53
                            emsisoft.bit
                            dns
                            58 B
                             133 B
                             1
                            1

                            DNS Request

                            emsisoft.bit

                          • 8.8.8.8:53
                            dns1.soprodns.ru
                            dns
                            nslookup.exe
                            62 B
                             123 B
                             1
                            1

                            DNS Request

                            dns1.soprodns.ru

                          • 8.8.8.8:53
                            8.8.8.8.in-addr.arpa
                            dns
                            66 B
                             90 B
                             1
                            1

                            DNS Request

                            8.8.8.8.in-addr.arpa

                          • 8.8.8.8:53
                            gandcrab.bit
                            dns
                            58 B
                             133 B
                             1
                            1

                            DNS Request

                            gandcrab.bit

                          • 8.8.8.8:53
                            gandcrab.bit
                            dns
                            58 B
                             133 B
                             1
                            1

                            DNS Request

                            gandcrab.bit

                          • 8.8.8.8:53
                            gandcrab.bit
                            dns
                            58 B
                             133 B
                             1
                            1

                            DNS Request

                            gandcrab.bit

                          • 8.8.8.8:53
                            gandcrab.bit
                            dns
                            58 B
                             133 B
                             1
                            1

                            DNS Request

                            gandcrab.bit

                          • 8.8.8.8:53
                            28.73.42.20.in-addr.arpa
                            dns
                            70 B
                             156 B
                             1
                            1

                            DNS Request

                            28.73.42.20.in-addr.arpa

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          We care about your privacy.

                          This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.