dcf1278b4b32ef04073a27dde7025b6ab12f48375a1bb622ce9d03f154c15b04

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/08/2026, 12:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe
Size 69KB
Sample260823-p25mtsgp21
SHA256 dcf1278b4b32ef04073a27dde7025b6ab12f48375a1bb622ce9d03f154c15b04
MD5 0ba8440815d19a6a7dd2895ef934c872
SHA1 bddf546657f15c0d900c372fead9893e81a7bba7
SHA512 7b190ff30a73a08ed9902f94c24becb49d23dcc3af0c44a48e9d1d46333823210913ed2005467cadad90db89b50aa52d637b36e8aa213b068cc18e983610f8ce
SSDEEP 768:IXIxo9TZkKFN7Vf3sohEJH5co/iej2JWOkKgTiGMqWNUMFAHJ9E3lvd6s:iIxo9TNFA9coqlWOkKgdMqqUM2Lkvd6
TLSH
T1F9633C00B1E181A6F1F26AB1EFFCAD56656D7D211B3E9BCB0CD4084A0C1A9F29A35717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\uxruniyawcg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe"	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe
File opened (read-only)	\??\G:	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe
File opened (read-only)	\??\H:	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe
File opened (read-only)	\??\O:	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe
File opened (read-only)	\??\Q:	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe
File opened (read-only)	\??\Y:	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe
File opened (read-only)	\??\Z:	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe
File opened (read-only)	\??\N:	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe
File opened (read-only)	\??\P:	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe
File opened (read-only)	\??\S:	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe
File opened (read-only)	\??\T:	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe
File opened (read-only)	\??\W:	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe
File opened (read-only)	\??\J:	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe
File opened (read-only)	\??\U:	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe
File opened (read-only)	\??\E:	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe
File opened (read-only)	\??\I:	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe
File opened (read-only)	\??\K:	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe
File opened (read-only)	\??\L:	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe
File opened (read-only)	\??\M:	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe
File opened (read-only)	\??\R:	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe
File opened (read-only)	\??\V:	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe
File opened (read-only)	\??\X:	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe
File opened (read-only)	\??\A:	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe
2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe
2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe
2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 3484	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	87
PID 2320 wrote to memory of 5108	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	92
PID 2320 wrote to memory of 3076	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	95
PID 2320 wrote to memory of 2484	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	99
PID 2320 wrote to memory of 3428	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	102
PID 2320 wrote to memory of 2032	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	107
PID 2320 wrote to memory of 3780	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	111
PID 2320 wrote to memory of 1184	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	114
PID 2320 wrote to memory of 3632	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	117
PID 2320 wrote to memory of 1084	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	120
PID 2320 wrote to memory of 4692	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	123
PID 2320 wrote to memory of 2176	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	126
PID 2320 wrote to memory of 4676	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	130
PID 2320 wrote to memory of 3932	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	134
PID 2320 wrote to memory of 2428	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	137
PID 2320 wrote to memory of 4328	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	141
PID 2320 wrote to memory of 2028	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	144
PID 2320 wrote to memory of 3920	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	147
PID 2320 wrote to memory of 4172	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	154
PID 2320 wrote to memory of 1000	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	160
PID 2320 wrote to memory of 2160	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	163
PID 2320 wrote to memory of 2804	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	168
PID 2320 wrote to memory of 5112	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	171
PID 2320 wrote to memory of 4908	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	177
PID 2320 wrote to memory of 2864	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	181
PID 2320 wrote to memory of 4288	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	184
PID 2320 wrote to memory of 432	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	187
PID 2320 wrote to memory of 3580	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	191
PID 2320 wrote to memory of 4196	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	194
PID 2320 wrote to memory of 1852	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	197
PID 2320 wrote to memory of 3888	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	201
PID 2320 wrote to memory of 1648	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	204
PID 2320 wrote to memory of 2044	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	207
PID 2320 wrote to memory of 4700	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	211
PID 2320 wrote to memory of 2344	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	214
PID 2320 wrote to memory of 2100	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	217
PID 2320 wrote to memory of 4112	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	221
PID 2320 wrote to memory of 4604	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	224
PID 2320 wrote to memory of 1900	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	227
PID 2320 wrote to memory of 3628	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	231
PID 2320 wrote to memory of 5032	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	234
PID 2320 wrote to memory of 2180	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	237
PID 2320 wrote to memory of 464	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	241
PID 2320 wrote to memory of 552	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	244
PID 2320 wrote to memory of 4684	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	247
PID 2320 wrote to memory of 2136	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	252
PID 2320 wrote to memory of 764	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	256
PID 2320 wrote to memory of 1864	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	260
PID 2320 wrote to memory of 4444	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	264
PID 2320 wrote to memory of 220	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	267
PID 2320 wrote to memory of 4848	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	270
PID 2320 wrote to memory of 3968	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	274
PID 2320 wrote to memory of 4144	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	277
PID 2320 wrote to memory of 2188	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	280
PID 2320 wrote to memory of 2240	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	284
PID 2320 wrote to memory of 1164	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	287
PID 2320 wrote to memory of 3300	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	290
PID 2320 wrote to memory of 4024	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	294
PID 2320 wrote to memory of 2640	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	297
PID 2320 wrote to memory of 180	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	300
PID 2320 wrote to memory of 4412	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	304
PID 2320 wrote to memory of 4628	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	307
PID 2320 wrote to memory of 1656	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	310
PID 2320 wrote to memory of 4232	2320	2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe	314

C:\Users\Admin\AppData\Local\Temp\2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3484
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5108
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3076
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2484
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3428
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2032
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:3780
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1184
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3632
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1084
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:4692
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2176
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4676
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3932
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2428
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:4328
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2028
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3920
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4172
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1000
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2160
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2804
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5112
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:4908
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2864
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4288
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:432
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3580
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4196
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1852
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:3888
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1648
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2044
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:4700
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2344
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2100
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:4112
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:4604
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1900
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3628
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:5032
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2180
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:464
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:552
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4684
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2136
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:764
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1864
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4444
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:220
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4848
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3968
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:4144
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2188
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2240
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1164
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3300
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:4024
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2640
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:180
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4412
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4628
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1656
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4232
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:824
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4500
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1828
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1984
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1428
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:792
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1160
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:3684
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3372
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2980
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4812
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3528
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4820
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4044
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4680
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1564
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2400
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:3096
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3324
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4256
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:3052
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2876
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:3924
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2472
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:624
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:3308

C:\Users\Admin\AppData\Local\Temp\2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe
C:\Users\Admin\AppData\Local\Temp\2026-08-22_0ba8440815d19a6a7dd2895ef934c872_elex_gandcrab.exe
1⤵
- Checks processor information in registry
PID:1232