General
-
Target
SecuriteInfo.com.Mal.GandCrypt-A.26403.26463
-
Size
176KB
-
Sample
210331-lhhpkr3an6
-
MD5
de276c3b5b196028e89b37f04230a39d
-
SHA1
77df36a5cccf073b4fb998efe4e42df8b78e3277
-
SHA256
ed4c8f72e049a22a51ff3d1b871fb42c1e333d4831710b7180e040d5a27a8b24
-
SHA512
0268a4deb27a2874a7796086e1635b325ac98d2a83d93521a8b3fb7fc3142d3165a55724b411bf5934a1c80c7096374690afebf4edbf0d57a954343de4a5a4ea
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Mal.GandCrypt-A.26403.26463.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Mal.GandCrypt-A.26403.26463.exe
Resource
win10v20201028
Malware Config
Extracted
smokeloader
2020
http://xsss99.icu/upload/
http://bingooodsg.icu/upload/
http://junntd.xyz/upload/
http://ginessa11.xyz/upload/
http://overplayninsx.xyz/upload/
http://bananinze.com/upload/
http://daunimlas.com/upload/
Targets
-
-
Target
SecuriteInfo.com.Mal.GandCrypt-A.26403.26463
-
Size
176KB
-
MD5
de276c3b5b196028e89b37f04230a39d
-
SHA1
77df36a5cccf073b4fb998efe4e42df8b78e3277
-
SHA256
ed4c8f72e049a22a51ff3d1b871fb42c1e333d4831710b7180e040d5a27a8b24
-
SHA512
0268a4deb27a2874a7796086e1635b325ac98d2a83d93521a8b3fb7fc3142d3165a55724b411bf5934a1c80c7096374690afebf4edbf0d57a954343de4a5a4ea
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Creates new service(s)
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Deletes itself
-
Loads dropped DLL
-
Modifies file permissions
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v6
Persistence
New Service
1Modify Existing Service
1Registry Run Keys / Startup Folder
2Bootkit
1Defense Evasion
Impair Defenses
1Modify Registry
3File Permissions Modification
1Install Root Certificate
1