gandcrab | b6dc09c8def3257e0ed93f8b960bc77944170167f15303d1c7102a4d4da2d96e

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 00:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Size 97KB
Sample260823-arrkwsgh64
SHA256 b6dc09c8def3257e0ed93f8b960bc77944170167f15303d1c7102a4d4da2d96e
MD5 c9c6799082276634a0e96ee4f0cb946c
SHA1 5b5b37122768a3904a768f60367bcd458ca36933
SHA512 a651d381fb8e19cd7426b003f57346e2ff02cfc00f9eaec3fac18a9dd820c1d041892c241a2b84158ed0e364f7e0125c16506b5873851e054be25521ee1c0189
SSDEEP 1536:uZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAEMqqU+2bbbAV2/S2LNmHkD:4BounVyFHFMqqDL2/LgHkc2
TLSH
T188A36C0AB3E16293E1F25779FA747E66456E3D10BB249BDB09D348862D630F0293B713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery gandcrab persistence ransomware upx

Malware Config

Signatures

Family: Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab

GandCrab payload 3 IoCs

resource	yara_rule
behavioral2/memory/4924-0-0x000000000FAE0000-0x000000000FAFB000-memory.dmp	family_gandcrab
behavioral2/memory/3152-3-0x000000000FAE0000-0x000000000FAFB000-memory.dmp	family_gandcrab
behavioral2/memory/4924-4-0x000000000FAE0000-0x000000000FAFB000-memory.dmp	family_gandcrab

Detects Reflective DLL injection artifacts 3 IoCs

resource	yara_rule
behavioral2/memory/4924-0-0x000000000FAE0000-0x000000000FAFB000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/memory/3152-3-0x000000000FAE0000-0x000000000FAFB000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/memory/4924-4-0x000000000FAE0000-0x000000000FAFB000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects ransomware indicator 3 IoCs

resource	yara_rule
behavioral2/memory/4924-0-0x000000000FAE0000-0x000000000FAFB000-memory.dmp	SUSP_RANSOMWARE_Indicator_Jul20
behavioral2/memory/3152-3-0x000000000FAE0000-0x000000000FAFB000-memory.dmp	SUSP_RANSOMWARE_Indicator_Jul20
behavioral2/memory/4924-4-0x000000000FAE0000-0x000000000FAFB000-memory.dmp	SUSP_RANSOMWARE_Indicator_Jul20

Gandcrab Payload 3 IoCs

resource	yara_rule
behavioral2/memory/4924-0-0x000000000FAE0000-0x000000000FAFB000-memory.dmp	Gandcrab
behavioral2/memory/3152-3-0x000000000FAE0000-0x000000000FAFB000-memory.dmp	Gandcrab
behavioral2/memory/4924-4-0x000000000FAE0000-0x000000000FAFB000-memory.dmp	Gandcrab

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral2/memory/4924-0-0x000000000FAE0000-0x000000000FAFB000-memory.dmp	UPX
behavioral2/memory/3152-3-0x000000000FAE0000-0x000000000FAFB000-memory.dmp	UPX
behavioral2/memory/4924-4-0x000000000FAE0000-0x000000000FAFB000-memory.dmp	UPX

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\kgorgmqcvft = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe"	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
File opened (read-only)	\??\A:	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
File opened (read-only)	\??\O:	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
File opened (read-only)	\??\S:	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
File opened (read-only)	\??\U:	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
File opened (read-only)	\??\W:	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
File opened (read-only)	\??\X:	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
File opened (read-only)	\??\G:	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
File opened (read-only)	\??\J:	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
File opened (read-only)	\??\R:	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
File opened (read-only)	\??\V:	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
File opened (read-only)	\??\Z:	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
File opened (read-only)	\??\B:	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
File opened (read-only)	\??\D:	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
File opened (read-only)	\??\H:	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
File opened (read-only)	\??\K:	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
File opened (read-only)	\??\M:	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
File opened (read-only)	\??\P:	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
File opened (read-only)	\??\I:	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
File opened (read-only)	\??\L:	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
File opened (read-only)	\??\N:	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
File opened (read-only)	\??\T:	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
File opened (read-only)	\??\Y:	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4924-0-0x000000000FAE0000-0x000000000FAFB000-memory.dmp	upx
behavioral2/memory/3152-3-0x000000000FAE0000-0x000000000FAFB000-memory.dmp	upx
behavioral2/memory/4924-4-0x000000000FAE0000-0x000000000FAFB000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
Token: SeDebugPrivilege	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 4652	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	90
PID 4924 wrote to memory of 1084	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	93
PID 4924 wrote to memory of 5012	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	95
PID 4924 wrote to memory of 6000	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	97
PID 4924 wrote to memory of 5036	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	99
PID 4924 wrote to memory of 1124	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	101
PID 4924 wrote to memory of 2092	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	103
PID 4924 wrote to memory of 1360	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	105
PID 4924 wrote to memory of 6004	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	107
PID 4924 wrote to memory of 5800	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	109
PID 4924 wrote to memory of 2912	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	112
PID 4924 wrote to memory of 5960	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	114
PID 4924 wrote to memory of 3540	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	116
PID 4924 wrote to memory of 4944	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	118
PID 4924 wrote to memory of 3688	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	120
PID 4924 wrote to memory of 464	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	122
PID 4924 wrote to memory of 4312	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	124
PID 4924 wrote to memory of 2116	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	126
PID 4924 wrote to memory of 3772	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	128
PID 4924 wrote to memory of 3964	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	130
PID 4924 wrote to memory of 5432	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	132
PID 4924 wrote to memory of 5608	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	135
PID 4924 wrote to memory of 4420	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	137
PID 4924 wrote to memory of 5784	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	139
PID 4924 wrote to memory of 2492	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	141
PID 4924 wrote to memory of 3032	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	143
PID 4924 wrote to memory of 5992	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	145
PID 4924 wrote to memory of 5760	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	147
PID 4924 wrote to memory of 5292	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	149
PID 4924 wrote to memory of 3684	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	151
PID 4924 wrote to memory of 1768	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	153
PID 4924 wrote to memory of 4856	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	155
PID 4924 wrote to memory of 5356	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	157
PID 4924 wrote to memory of 3268	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	159
PID 4924 wrote to memory of 4732	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	161
PID 4924 wrote to memory of 2832	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	163
PID 4924 wrote to memory of 4144	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	165
PID 4924 wrote to memory of 4772	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	167
PID 4924 wrote to memory of 2644	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	169
PID 4924 wrote to memory of 4552	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	171
PID 4924 wrote to memory of 5660	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	173
PID 4924 wrote to memory of 4264	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	175
PID 4924 wrote to memory of 2404	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	177
PID 4924 wrote to memory of 4860	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	179
PID 4924 wrote to memory of 3376	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	181
PID 4924 wrote to memory of 4912	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	183
PID 4924 wrote to memory of 6088	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	185
PID 4924 wrote to memory of 3060	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	187
PID 4924 wrote to memory of 3912	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	189
PID 4924 wrote to memory of 4192	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	191
PID 4924 wrote to memory of 1848	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	193
PID 4924 wrote to memory of 5360	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	195
PID 4924 wrote to memory of 5184	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	197
PID 4924 wrote to memory of 2068	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	199
PID 4924 wrote to memory of 1448	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	201
PID 4924 wrote to memory of 3660	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	203
PID 4924 wrote to memory of 4384	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	205
PID 4924 wrote to memory of 1572	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	207
PID 4924 wrote to memory of 5404	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	209
PID 4924 wrote to memory of 428	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	211
PID 4924 wrote to memory of 2856	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	213
PID 4924 wrote to memory of 968	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	215
PID 4924 wrote to memory of 4696	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	217
PID 4924 wrote to memory of 3424	4924	2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe	219

C:\Users\Admin\AppData\Local\Temp\2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4652
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1084
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:5012
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6000
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5036
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:1124
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2092
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1360
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:6004
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5800
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2912
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5960
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:3540
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:4944
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:3688
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:464
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4312
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2116
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:3772
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:3964
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5432
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5608
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4420
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:5784
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2492
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:3032
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:5992
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5760
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5292
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:3684
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1768
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:4856
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5356
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3268
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4732
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2832
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4144
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:4772
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2644
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:4552
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5660
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:4264
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2404
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:4860
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:3376
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4912
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6088
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3060
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:3912
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4192
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1848
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:5360
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:5184
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2068
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1448
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3660
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4384
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1572
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5404
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:428
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2856
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:968
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:4696
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3424
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2732
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4992
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:5836
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:4372
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4728
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1368
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:3452
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:5620
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6008
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2524
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:5680
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6016
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5532
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4776
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2252
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3940
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2988
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3696
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3104
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:6132
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2984
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:700
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:3464
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5288
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:4556
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:3692
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2860
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2760
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:5796
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2528
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4956
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:612
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3896
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2208
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3300
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3984
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1104
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:3124
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:4724
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:924
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:3780
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1556
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2792
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:1672
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:3028
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:4352
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5096
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3264
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1276
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5180

C:\Users\Admin\AppData\Local\Temp\2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
C:\Users\Admin\AppData\Local\Temp\2026-08-22_c9c6799082276634a0e96ee4f0cb946c_coinminer_elex_gandcrab.exe
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:3152