a6b9ef8441b9f6c3a766c33d9b506c2f48d6a92de386f3c47e63c8e9765c5ba8

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 21:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe
Size 69KB
Sample260828-1gdjdstdpd
SHA256 a6b9ef8441b9f6c3a766c33d9b506c2f48d6a92de386f3c47e63c8e9765c5ba8
MD5 13c395bb808c0b8399522510f07dc1e9
SHA1 412b46eb56ee593ed49ef47495250bf023fa6a04
SHA512 b45d9793756d5034b1092d29d54457530b911b5349f2728bbffc8a150fd1ceeeb79d48e13d1c307063bce518011abcc9cefb660eadec4858af76e3b4423f07cc
SSDEEP 1536:izzzzzzzzV9rXounV98hbHnAXMqqUM2Lkvd68:ABounVyFHCMqqMLkvdd
TLSH
T1D4631804B2E24293F2F35BB4B9B96A62496F3C203B289BDB49D7091A5C535F17D36703
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ppwvxilbxub = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe"	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe
File opened (read-only)	\??\K:	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe
File opened (read-only)	\??\L:	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe
File opened (read-only)	\??\O:	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe
File opened (read-only)	\??\R:	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe
File opened (read-only)	\??\V:	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe
File opened (read-only)	\??\Y:	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe
File opened (read-only)	\??\B:	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe
File opened (read-only)	\??\M:	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe
File opened (read-only)	\??\Q:	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe
File opened (read-only)	\??\T:	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe
File opened (read-only)	\??\W:	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe
File opened (read-only)	\??\H:	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe
File opened (read-only)	\??\P:	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe
File opened (read-only)	\??\A:	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe
File opened (read-only)	\??\E:	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe
File opened (read-only)	\??\I:	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe
File opened (read-only)	\??\N:	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe
File opened (read-only)	\??\S:	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe
File opened (read-only)	\??\U:	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe
File opened (read-only)	\??\X:	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe
File opened (read-only)	\??\Z:	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe
File opened (read-only)	\??\G:	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe
4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe
4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe
4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 6064	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	86
PID 4032 wrote to memory of 5720	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	90
PID 4032 wrote to memory of 968	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	95
PID 4032 wrote to memory of 2520	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	101
PID 4032 wrote to memory of 6028	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	105
PID 4032 wrote to memory of 5188	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	108
PID 4032 wrote to memory of 5524	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	114
PID 4032 wrote to memory of 2056	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	118
PID 4032 wrote to memory of 3292	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	121
PID 4032 wrote to memory of 980	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	125
PID 4032 wrote to memory of 2060	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	128
PID 4032 wrote to memory of 5340	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	131
PID 4032 wrote to memory of 5500	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	135
PID 4032 wrote to memory of 2540	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	138
PID 4032 wrote to memory of 5780	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	141
PID 4032 wrote to memory of 4880	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	145
PID 4032 wrote to memory of 2244	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	148
PID 4032 wrote to memory of 1000	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	151
PID 4032 wrote to memory of 3828	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	155
PID 4032 wrote to memory of 2336	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	160
PID 4032 wrote to memory of 3488	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	163
PID 4032 wrote to memory of 1684	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	167
PID 4032 wrote to memory of 2428	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	170
PID 4032 wrote to memory of 456	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	173
PID 4032 wrote to memory of 4900	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	177
PID 4032 wrote to memory of 5184	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	180
PID 4032 wrote to memory of 1136	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	183
PID 4032 wrote to memory of 5056	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	186
PID 4032 wrote to memory of 3312	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	189
PID 4032 wrote to memory of 2136	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	192
PID 4032 wrote to memory of 512	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	196
PID 4032 wrote to memory of 4152	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	199
PID 4032 wrote to memory of 3504	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	202
PID 4032 wrote to memory of 5192	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	205
PID 4032 wrote to memory of 5584	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	208
PID 4032 wrote to memory of 4176	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	211
PID 4032 wrote to memory of 4384	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	215
PID 4032 wrote to memory of 3792	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	218
PID 4032 wrote to memory of 5408	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	221
PID 4032 wrote to memory of 2696	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	225
PID 4032 wrote to memory of 552	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	228
PID 4032 wrote to memory of 4340	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	231
PID 4032 wrote to memory of 4620	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	235
PID 4032 wrote to memory of 2560	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	238
PID 4032 wrote to memory of 5204	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	241
PID 4032 wrote to memory of 812	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	245
PID 4032 wrote to memory of 5840	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	248
PID 4032 wrote to memory of 4116	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	251
PID 4032 wrote to memory of 3728	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	255
PID 4032 wrote to memory of 464	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	258
PID 4032 wrote to memory of 3064	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	261
PID 4032 wrote to memory of 5552	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	264
PID 4032 wrote to memory of 5848	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	267
PID 4032 wrote to memory of 4516	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	270
PID 4032 wrote to memory of 2284	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	274
PID 4032 wrote to memory of 684	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	277
PID 4032 wrote to memory of 3128	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	280
PID 4032 wrote to memory of 5484	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	283
PID 4032 wrote to memory of 2496	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	286
PID 4032 wrote to memory of 6124	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	289
PID 4032 wrote to memory of 6036	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	292
PID 4032 wrote to memory of 5816	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	295
PID 4032 wrote to memory of 1924	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	298
PID 4032 wrote to memory of 4416	4032	2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe	302

C:\Users\Admin\AppData\Local\Temp\2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6064
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5720
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:968
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2520
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6028
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5188
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:5524
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2056
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3292
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:980
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2060
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5340
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:5500
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2540
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5780
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:4880
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2244
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1000
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3828
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2336
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3488
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1684
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2428
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:456
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4900
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5184
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1136
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5056
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:3312
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2136
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:512
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4152
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:3504
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:5192
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:5584
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:4176
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4384
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3792
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:5408
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2696
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:552
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4340
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:4620
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2560
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5204
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:812
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:5840
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4116
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:3728
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:464
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3064
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5552
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:5848
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4516
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2284
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:684
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:3128
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5484
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2496
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6124
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6036
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:5816
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1924
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4416
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4444
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3784
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:748
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2656
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4972
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3596
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5944
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3444
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:3956
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5828
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1492
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3256
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:4688
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:5872
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:5912
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5040
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:4920
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4572
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4260
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1980
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5964
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:4120
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3812
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2892
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:3472
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3100
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1368
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1072
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3300
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2124
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5432
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:5680
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:4808
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:2448
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2756

C:\Users\Admin\AppData\Local\Temp\2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe
C:\Users\Admin\AppData\Local\Temp\2026-08-28_13c395bb808c0b8399522510f07dc1e9_elex_gandcrab.exe
1⤵
- Checks processor information in registry
PID:5896