gandcrab | cf7f34edeef50cc39769505d19cbd9b7e280033b836443ce3b753c13e8475d76

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 09:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Size 69KB
Sample260823-lpdrssvgpf
SHA256 cf7f34edeef50cc39769505d19cbd9b7e280033b836443ce3b753c13e8475d76
MD5 3c71ee97eab8e5b5f98c8082c724a46c
SHA1 e294ea602f3c6f01d73167ddeb2a2ee30353621e
SHA512 ffbdc4f6e239db7de2371bb91fade6660ffd17d991126941d3f6ca340632468a801e1521f47306aaa60856bdcd11add67a5411a7b24f77e1a1c55fbd83813305
SSDEEP 1536:hZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAmMqqU+2bbbAV2/S2Lccu3i:dBounVyFHjMqqDL2/Lcc
TLSH
T176636A0D72E1A293E1F357B9FAB57E65446E3D203B249BEB4893598529630F0793B303
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery gandcrab persistence ransomware

Malware Config

Signatures

Family: Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab

GandCrab payload 1 IoCs

resource	yara_rule
behavioral2/memory/3640-0-0x000000000F200000-0x000000000F216000-memory.dmp	family_gandcrab

Detects Reflective DLL injection artifacts 1 IoCs

resource	yara_rule
behavioral2/memory/3640-0-0x000000000F200000-0x000000000F216000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects ransomware indicator 1 IoCs

resource	yara_rule
behavioral2/memory/3640-0-0x000000000F200000-0x000000000F216000-memory.dmp	SUSP_RANSOMWARE_Indicator_Jul20

Gandcrab Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3640-0-0x000000000F200000-0x000000000F216000-memory.dmp	Gandcrab

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ukgigkcnosh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe"	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
File opened (read-only)	\??\D:	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
File opened (read-only)	\??\H:	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
File opened (read-only)	\??\J:	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
File opened (read-only)	\??\K:	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
File opened (read-only)	\??\L:	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
File opened (read-only)	\??\N:	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
File opened (read-only)	\??\O:	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
File opened (read-only)	\??\A:	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
File opened (read-only)	\??\G:	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
File opened (read-only)	\??\I:	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
File opened (read-only)	\??\M:	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
File opened (read-only)	\??\S:	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
File opened (read-only)	\??\U:	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
File opened (read-only)	\??\W:	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
File opened (read-only)	\??\X:	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
File opened (read-only)	\??\P:	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
File opened (read-only)	\??\R:	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
File opened (read-only)	\??\T:	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
File opened (read-only)	\??\V:	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
File opened (read-only)	\??\Z:	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
File opened (read-only)	\??\B:	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
File opened (read-only)	\??\Y:	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
Token: SeDebugPrivilege	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3640 wrote to memory of 2676	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	89
PID 3640 wrote to memory of 3624	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	93
PID 3640 wrote to memory of 1116	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	95
PID 3640 wrote to memory of 4224	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	97
PID 3640 wrote to memory of 5476	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	99
PID 3640 wrote to memory of 4796	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	101
PID 3640 wrote to memory of 3968	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	103
PID 3640 wrote to memory of 256	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	105
PID 3640 wrote to memory of 4484	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	107
PID 3640 wrote to memory of 1180	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	109
PID 3640 wrote to memory of 1748	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	111
PID 3640 wrote to memory of 708	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	113
PID 3640 wrote to memory of 2440	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	115
PID 3640 wrote to memory of 1324	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	117
PID 3640 wrote to memory of 944	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	119
PID 3640 wrote to memory of 2388	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	121
PID 3640 wrote to memory of 5916	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	123
PID 3640 wrote to memory of 3096	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	125
PID 3640 wrote to memory of 5612	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	128
PID 3640 wrote to memory of 3400	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	130
PID 3640 wrote to memory of 1084	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	132
PID 3640 wrote to memory of 2396	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	134
PID 3640 wrote to memory of 4576	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	136
PID 3640 wrote to memory of 5136	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	138
PID 3640 wrote to memory of 2572	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	140
PID 3640 wrote to memory of 988	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	142
PID 3640 wrote to memory of 1612	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	144
PID 3640 wrote to memory of 5148	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	146
PID 3640 wrote to memory of 1212	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	148
PID 3640 wrote to memory of 4152	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	150
PID 3640 wrote to memory of 5784	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	152
PID 3640 wrote to memory of 1876	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	154
PID 3640 wrote to memory of 3356	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	156
PID 3640 wrote to memory of 6028	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	158
PID 3640 wrote to memory of 3656	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	160
PID 3640 wrote to memory of 1904	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	162
PID 3640 wrote to memory of 296	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	164
PID 3640 wrote to memory of 4844	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	166
PID 3640 wrote to memory of 5280	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	168
PID 3640 wrote to memory of 4212	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	170
PID 3640 wrote to memory of 6004	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	172
PID 3640 wrote to memory of 1708	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	174
PID 3640 wrote to memory of 3376	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	176
PID 3640 wrote to memory of 6012	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	178
PID 3640 wrote to memory of 5560	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	180
PID 3640 wrote to memory of 4264	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	182
PID 3640 wrote to memory of 3164	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	184
PID 3640 wrote to memory of 4100	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	186
PID 3640 wrote to memory of 4172	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	188
PID 3640 wrote to memory of 3180	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	190
PID 3640 wrote to memory of 4608	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	192
PID 3640 wrote to memory of 2120	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	194
PID 3640 wrote to memory of 4744	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	196
PID 3640 wrote to memory of 4428	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	198
PID 3640 wrote to memory of 4268	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	200
PID 3640 wrote to memory of 1220	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	202
PID 3640 wrote to memory of 1224	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	204
PID 3640 wrote to memory of 5748	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	206
PID 3640 wrote to memory of 3124	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	208
PID 3640 wrote to memory of 2904	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	210
PID 3640 wrote to memory of 2508	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	212
PID 3640 wrote to memory of 4112	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	214
PID 3640 wrote to memory of 2384	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	216
PID 3640 wrote to memory of 4372	3640	2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe	218

C:\Users\Admin\AppData\Local\Temp\2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3640
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2676
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3624
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1116
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:4224
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5476
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:4796
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3968
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:256
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4484
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1180
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1748
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:708
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2440
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1324
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:944
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2388
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5916
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:3096
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5612
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:3400
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1084
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2396
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4576
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:5136
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2572
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:988
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1612
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:5148
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1212
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:4152
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5784
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1876
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3356
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:6028
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3656
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1904
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:296
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4844
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5280
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4212
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6004
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1708
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3376
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6012
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5560
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4264
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:3164
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4100
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4172
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3180
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:4608
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2120
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4744
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4428
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:4268
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1220
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1224
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:5748
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:3124
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2904
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2508
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4112
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2384
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4372
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:724
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4572
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5700
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4180
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2908
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:5996
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:6036
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6096
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:4896
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:5016
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2788
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1732
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5180
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:1312
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:480
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3500
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1572
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3980
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:3892
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:1492
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5732
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:548
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5264
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2976
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5192
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5368
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2980
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3776
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3248

C:\Users\Admin\AppData\Local\Temp\2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
C:\Users\Admin\AppData\Local\Temp\2026-08-22_3c71ee97eab8e5b5f98c8082c724a46c_elex_gandcrab.exe
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:2620