4af4c0192211f7e1d6b77353e3102f124e37d8d57493c5d0ebef3d0fb51ca79d

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/10/2026, 07:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe
Size 69KB
Sample261011-jpblbsxzhy
SHA256 4af4c0192211f7e1d6b77353e3102f124e37d8d57493c5d0ebef3d0fb51ca79d
MD5 97ffa07018893de580538689e7e05587
SHA1 1a249a636eb7413962abe6f4776ee2290ce5c955
SHA512 e877cc628f3f8d9ca8bca4815ddb83e3208e814805ef8ab4e955dc24b7355e67740258f8d81d1f200d3760fd9bc49741b32348ce3da03a0ecdd94be070925a0a
SSDEEP 1536:tZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAwfMqqU+2bbbAV2/S2Lkvd9:RBounVyFHpfMqqDL2/Lkvd
TLSH
T14C636A0EA2E1A193E1F357B9FA757E65446E3D203B289BDB099359852D630F0793B303
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\dwcsbtgsjgf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe"	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe
File opened (read-only)	\??\K:	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe
File opened (read-only)	\??\L:	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe
File opened (read-only)	\??\A:	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe
File opened (read-only)	\??\J:	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe
File opened (read-only)	\??\R:	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe
File opened (read-only)	\??\Z:	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe
File opened (read-only)	\??\I:	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe
File opened (read-only)	\??\M:	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe
File opened (read-only)	\??\N:	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe
File opened (read-only)	\??\T:	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe
File opened (read-only)	\??\W:	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe
File opened (read-only)	\??\X:	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe
File opened (read-only)	\??\Y:	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe
File opened (read-only)	\??\E:	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe
File opened (read-only)	\??\H:	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe
File opened (read-only)	\??\O:	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe
File opened (read-only)	\??\P:	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe
File opened (read-only)	\??\Q:	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe
File opened (read-only)	\??\S:	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe
File opened (read-only)	\??\U:	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe
File opened (read-only)	\??\V:	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe
File opened (read-only)	\??\B:	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 3 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe
1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe
1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe
1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 1464	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	90
PID 1808 wrote to memory of 2400	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	97
PID 1808 wrote to memory of 5008	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	102
PID 1808 wrote to memory of 4076	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	106
PID 1808 wrote to memory of 4760	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	110
PID 1808 wrote to memory of 1952	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	113
PID 1808 wrote to memory of 2624	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	118
PID 1808 wrote to memory of 4456	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	122
PID 1808 wrote to memory of 3972	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	125
PID 1808 wrote to memory of 1020	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	129
PID 1808 wrote to memory of 860	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	132
PID 1808 wrote to memory of 2212	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	135
PID 1808 wrote to memory of 5316	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	139
PID 1808 wrote to memory of 3580	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	142
PID 1808 wrote to memory of 2932	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	145
PID 1808 wrote to memory of 1604	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	148
PID 1808 wrote to memory of 5116	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	151
PID 1808 wrote to memory of 1580	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	154
PID 1808 wrote to memory of 1960	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	158
PID 1808 wrote to memory of 5980	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	161
PID 1808 wrote to memory of 4228	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	164
PID 1808 wrote to memory of 4912	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	169
PID 1808 wrote to memory of 2608	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	173
PID 1808 wrote to memory of 2040	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	177
PID 1808 wrote to memory of 1720	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	182
PID 1808 wrote to memory of 5992	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	189
PID 1808 wrote to memory of 4816	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	192
PID 1808 wrote to memory of 1084	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	196
PID 1808 wrote to memory of 4596	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	199
PID 1808 wrote to memory of 3920	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	202
PID 1808 wrote to memory of 3052	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	206
PID 1808 wrote to memory of 3796	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	209
PID 1808 wrote to memory of 2540	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	212
PID 1808 wrote to memory of 180	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	216
PID 1808 wrote to memory of 5504	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	219
PID 1808 wrote to memory of 1780	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	222
PID 1808 wrote to memory of 6104	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	226
PID 1808 wrote to memory of 452	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	229
PID 1808 wrote to memory of 1536	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	232
PID 1808 wrote to memory of 5956	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	235
PID 1808 wrote to memory of 1008	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	238
PID 1808 wrote to memory of 3556	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	241
PID 1808 wrote to memory of 4104	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	245
PID 1808 wrote to memory of 4640	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	248
PID 1808 wrote to memory of 4184	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	251
PID 1808 wrote to memory of 3256	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	254
PID 1808 wrote to memory of 4552	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	257
PID 1808 wrote to memory of 2908	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	260
PID 1808 wrote to memory of 3844	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	264
PID 1808 wrote to memory of 4472	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	267
PID 1808 wrote to memory of 4196	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	270
PID 1808 wrote to memory of 3392	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	274
PID 1808 wrote to memory of 1128	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	277
PID 1808 wrote to memory of 4676	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	281
PID 1808 wrote to memory of 1452	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	283
PID 1808 wrote to memory of 5716	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	286
PID 1808 wrote to memory of 1064	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	289
PID 1808 wrote to memory of 4448	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	293
PID 1808 wrote to memory of 2232	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	296
PID 1808 wrote to memory of 5676	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	299
PID 1808 wrote to memory of 2108	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	303
PID 1808 wrote to memory of 3984	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	306
PID 1808 wrote to memory of 3224	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	309
PID 1808 wrote to memory of 656	1808	2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe	313

C:\Users\Admin\AppData\Local\Temp\2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1464
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2400
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5008
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4076
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:4760
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1952
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2624
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:4456
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3972
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1020
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:860
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2212
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5316
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3580
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2932
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1604
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:5116
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1580
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1960
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:5980
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4228
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:4912
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2608
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2040
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1720
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:5992
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4816
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1084
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4596
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:3920
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:3052
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:3796
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2540
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:180
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:5504
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1780
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6104
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:452
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1536
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5956
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1008
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:3556
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4104
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4640
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:4184
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3256
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4552
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2908
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:3844
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4472
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4196
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3392
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1128
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4676
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1452
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5716
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1064
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:4448
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2232
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:5676
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2108
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:3984
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:3224
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:656
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4396
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:5180
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2288
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:3288
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:3292
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1540
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4708
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4508
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2836
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5568
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3812
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5580
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4332
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1028
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4308
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4348
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:5160
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:5044
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1596
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2984
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:3856
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4420
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3780
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2264
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:3108
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:6052
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:4468
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:4524
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:5508
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:4948
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2832
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4256
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:3396
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:2764
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4032
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1032
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:5432
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:3448
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6124
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:816
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6080
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5196
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:4392
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6120
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1992
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3368
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1616
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:4644
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1188
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3916
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1920
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1400

C:\Users\Admin\AppData\Local\Temp\2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe
C:\Users\Admin\AppData\Local\Temp\2026-10-10_97ffa07018893de580538689e7e05587_elex_gandcrab.exe
1⤵
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
PID:1540