518c5ea43ff2d85dbab8c416d316bba9e67d13a2b1ecce147aab344289212459

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/08/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe
Size 69KB
Sample260823-e5t1dssfqd
SHA256 518c5ea43ff2d85dbab8c416d316bba9e67d13a2b1ecce147aab344289212459
MD5 965ec603bfdba18580ea8b60caa4609c
SHA1 d66cf4aa4a17866d42d5a73977209393ce67e767
SHA512 66e797abead821e6ae8d1fd726bdd4b826b528ee75e482d2f66e71df4cc53bb0f883f807e1968c259f28ae8eb25c10cf27b4c40b8926fec403f991d672120646
SSDEEP 1536:wZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAwfMqqU+2bbbAV2/S2Lkvd9:eBounVyFHpfMqqDL2/Lkvd
TLSH
T18A636A0EA2E1A193E1F357B9FA757E65446E3D203B289BDB099359852D630F0793B303
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\czqvcsqkbec = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe"	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe
File opened (read-only)	\??\T:	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe
File opened (read-only)	\??\U:	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe
File opened (read-only)	\??\G:	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe
File opened (read-only)	\??\H:	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe
File opened (read-only)	\??\K:	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe
File opened (read-only)	\??\S:	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe
File opened (read-only)	\??\V:	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe
File opened (read-only)	\??\W:	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe
File opened (read-only)	\??\X:	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe
File opened (read-only)	\??\E:	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe
File opened (read-only)	\??\I:	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe
File opened (read-only)	\??\J:	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe
File opened (read-only)	\??\Y:	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe
File opened (read-only)	\??\Z:	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe
File opened (read-only)	\??\A:	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe
File opened (read-only)	\??\L:	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe
File opened (read-only)	\??\N:	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe
File opened (read-only)	\??\B:	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe
File opened (read-only)	\??\M:	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe
File opened (read-only)	\??\O:	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe
File opened (read-only)	\??\P:	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe
File opened (read-only)	\??\Q:	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe
2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe
2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe
2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 4956	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	87
PID 2252 wrote to memory of 2492	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	92
PID 2252 wrote to memory of 3076	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	95
PID 2252 wrote to memory of 912	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	99
PID 2252 wrote to memory of 3448	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	102
PID 2252 wrote to memory of 3400	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	105
PID 2252 wrote to memory of 4084	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	111
PID 2252 wrote to memory of 64	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	114
PID 2252 wrote to memory of 2504	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	117
PID 2252 wrote to memory of 764	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	121
PID 2252 wrote to memory of 3252	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	124
PID 2252 wrote to memory of 384	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	127
PID 2252 wrote to memory of 1804	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	131
PID 2252 wrote to memory of 2596	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	134
PID 2252 wrote to memory of 2472	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	137
PID 2252 wrote to memory of 5036	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	141
PID 2252 wrote to memory of 4756	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	144
PID 2252 wrote to memory of 2012	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	147
PID 2252 wrote to memory of 3968	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	152
PID 2252 wrote to memory of 4512	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	160
PID 2252 wrote to memory of 2160	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	164
PID 2252 wrote to memory of 3416	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	168
PID 2252 wrote to memory of 2820	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	172
PID 2252 wrote to memory of 2976	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	175
PID 2252 wrote to memory of 4392	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	181
PID 2252 wrote to memory of 2520	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	184
PID 2252 wrote to memory of 5080	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	187
PID 2252 wrote to memory of 4500	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	191
PID 2252 wrote to memory of 5016	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	194
PID 2252 wrote to memory of 852	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	197
PID 2252 wrote to memory of 4584	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	201
PID 2252 wrote to memory of 4172	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	204
PID 2252 wrote to memory of 4520	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	207
PID 2252 wrote to memory of 2092	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	211
PID 2252 wrote to memory of 2908	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	214
PID 2252 wrote to memory of 2068	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	218
PID 2252 wrote to memory of 3628	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	222
PID 2252 wrote to memory of 1228	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	225
PID 2252 wrote to memory of 4632	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	228
PID 2252 wrote to memory of 4028	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	232
PID 2252 wrote to memory of 2088	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	235
PID 2252 wrote to memory of 2432	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	238
PID 2252 wrote to memory of 4968	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	242
PID 2252 wrote to memory of 412	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	245
PID 2252 wrote to memory of 872	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	248
PID 2252 wrote to memory of 552	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	252
PID 2252 wrote to memory of 1824	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	255
PID 2252 wrote to memory of 2044	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	258
PID 2252 wrote to memory of 924	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	262
PID 2252 wrote to memory of 1920	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	265
PID 2252 wrote to memory of 3816	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	268
PID 2252 wrote to memory of 4180	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	271
PID 2252 wrote to memory of 2444	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	274
PID 2252 wrote to memory of 1052	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	277
PID 2252 wrote to memory of 5024	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	281
PID 2252 wrote to memory of 1508	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	284
PID 2252 wrote to memory of 3856	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	287
PID 2252 wrote to memory of 4204	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	291
PID 2252 wrote to memory of 4928	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	294
PID 2252 wrote to memory of 3972	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	297
PID 2252 wrote to memory of 3420	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	301
PID 2252 wrote to memory of 3188	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	304
PID 2252 wrote to memory of 2512	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	307
PID 2252 wrote to memory of 1992	2252	2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe	311

C:\Users\Admin\AppData\Local\Temp\2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4956
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2492
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3076
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:912
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3448
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3400
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4084
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:64
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2504
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:764
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:3252
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:384
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1804
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:2596
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2472
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5036
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:4756
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2012
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:3968
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:4512
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2160
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:3416
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2820
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2976
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4392
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2520
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5080
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4500
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5016
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:852
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4584
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4172
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:4520
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2092
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2908
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2068
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3628
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1228
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:4632
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4028
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2088
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2432
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4968
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:412
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:872
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:552
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1824
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2044
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:924
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1920
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3816
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4180
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2444
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1052
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5024
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1508
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3856
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4204
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4928
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3972
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:3420
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3188
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2512
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1992
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:512
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2628
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3700
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2964
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1912
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:5088
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1072
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3572
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1388
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:2460
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4948
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4908
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1196
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2032
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2372
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4276
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:3732
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:824
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5068
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2400
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1816
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:3944
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4032
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2952
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3604
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2428
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1356
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2780
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:4148
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1160
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:984

C:\Users\Admin\AppData\Local\Temp\2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe
C:\Users\Admin\AppData\Local\Temp\2026-08-22_965ec603bfdba18580ea8b60caa4609c_elex_gandcrab.exe
1⤵
- Checks processor information in registry
PID:2852