Overview

overview

10

Static

static

10

db2884a901...a9.exe

windows7_x64

10

db2884a901...a9.exe

windows10_x64

10

Analysis

  • max time kernel
    161s
  • max time network
    180s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    28-01-2022 17:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    db2884a9012cf6e8ea5b3fabb0d02a9487eb412e75085b37188d5e8f4ada7ca9.exe

  • Size

    191KB

  • MD5

    5bc5696a899074cb3623aa640602c8ad

  • SHA1

    792d0ef1d01d80426aabc2c8bbeb680690d94798

  • SHA256

    db2884a9012cf6e8ea5b3fabb0d02a9487eb412e75085b37188d5e8f4ada7ca9

  • SHA512

    7574237d9495c0cf056b67fb7efa61d426f383976e8fb73b2370835fd1ed63a85d0061c24ee16472bb973acd7cbbb690638b07bb20057774ace0e13b4f87e221

Score
10/10
gandcrabbackdoorransomwarespywarestealersuricataupx

Malware Config

Extracted

Path

C:\KRAB-DECRYPT.txt

Ransom Note
---= GANDCRAB V4 =--- Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .KRAB The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/cb99ace73fd0ad8 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAH1puCsQ4DEdXMJkqi47uZW7Nl7ZRwkRAp0Tf0eCPN7nSIsj7oujK+0alOSBNISAFmHWWGIoPAE0O7vr2M7qBmk9ujuyvKZy3moCoMRcYObs3obXWTeVL97p2v19xyCWpbN1DVGuIxEZ37HI3naO7g1HiCNliGy7GbZtcpFX8WylIjYvafC0CL+NLPd4R/I+nTK3aRPNPXU0uRjqPeZLPOkTxsIeUjEMeKbC24q1yM9QQ0BGA4lRh77X7gnUvdp+vSQ3QVGv2GtCbuvEonFPwKSIS2YctcQiWNNkLcCA6Tg3YRY6uSVFhC73v8na+JWwEp4vkW1bQ6jL7XGU8Grovymxs4GR7aN5LgI/0f8bqkELR1/4YwWzXIHJnCpz1bnlhDyxQs7GveUY5wwJmnpF/CFcy+o/R+i3y2X4+HGDhGionxBuSurEyWrtsrOIrB3L4kWjAxqb3BwB46864jbXefAZRvykykRWPvvlL9T0gsfo1mqKj/IkjZssBeinNLOw13WmNXwcQKWDADMkLFG8pZ+92GlDijZMSvWm3Led36m2ZCxQsgcou4X2PwZVzl/iLBNoRzeznZKx2CLiV227QW09Y1rc+u/GTYdShok471vr+/r8SjIWpBhexc3wBTQeZ8lEA7jnVtyr4LvxcmQNzJMyJdUAQs25U5FBZJP6I5lcjOriJWgKQ6DOMZMeBpowacDSc/UAV35NEo6hQ24/fLVag2Yf6/2wTY7SXh1Zfh04b5xGyBtIaB6py3x6R+wPuw2LIfq9mG1zv3xgbFZQFUlLbsVGPe4/qJBiottycqdcv+l7oNgf9rb06IYDMlSoZzpYeymxmrT4yUWDQ8Wlea61cknogJv2wQERq7ZCpvww/UjGGl1T1Z5y8u476zpM2kKOh3bABRk9eR34BIXRqcblM79MzljFsuyKBu60PBDtmWlKugwf33AFZAn9RcrJWZbTaWTy0FdBs1enzKG8rJL17uzx46XaPBQrnZGd2s8H7tElUZ6wLkzwFbRnX7ziWapqL8V8jgPZqIhaRIz1VMbh7rj/mp8QvCyKRg7lz/XbG19QQpiJfqe4+xFxYDSZSu1ExMsEaMIydAIldTGktcSDEl9ylRuXeZR+oJwVonT9yulIztFyMA70yiU8RWhAqLagwutDomyxMYqSuKLaqWYHgUYGY6mqLDAtsjQ6HUax0JdS7EAkidB7xli4TwqKxTdFrUwcVXpDjSWe+4bQfXcpoD+Nsx21IWLzBQ3aHNku5CvxW2/vA3Bl1FE1fEdhf3iB3taU3WEw1wgLgvABzG7pQTGcn9dV0mH/3UxLI/ECE3yh4HfOuNLhPr54afDrfG2J77WhNuooywNBXLhQmdSIDKUOl+OIwoDD1NPIvsNTb2gR3z+naslXYyQ3hZ4WDBvz7dIpax4SwghY4umQaFqY9KTrpX0Ud9pWz3EVmqJIaMmAIrWDIjiyejNd2dFm8oQQLvx1LqxYU3mAMxpCIwxBErWOBcZf4g86mM1a37ieMsojw380X/OvZOlOE+CCoHjATO4nanUY8DfEhRh4drTq1AAgfafo7q1f1J4CiXivpO/g3H6mMioCNkGwH3IbjByv7/3IxzlXkheWS2uB3+s7iXP+srpTLVyv4LGHXldGXzUxpmjf+hi+8uDibN0w40zwnqkcXwnHsXkTxD7rhedJqCISTYdXXwTik+ZhG+1etzkMeufoxGPFlH/Ub6iiTzajcKiyhgLyGfTKJCKFlJOLI8gsUMorznPOqVoyUbm9ZB7AS9RPdm9MXbOUPDlttbpifxKbD/JxEmjEoNinpX6KHFlsArK2mMcVGFgyCgy812BOWEDq1nOTykgwsyfWdCPKfUcUfg1eqGfbWxUmpQKW7UMsCOwqyg6lMbk9y0SSuU1/oNFaEd475LPB19yCGQngCNhPUqQZbaIKFFsdNZMpEGGJq5BokpQtWTMh1+DYfiJxvcgrKFvpuAFpiE//e/KqAaiJ8H5SgGz3RfEIJgszNsaVi0WXUkxdyAC0bc1iCK/soKXSuCWfShdYvLRUO1/Qj4UpnVD/PvWegqRqNmwWmr1kMo1MdH+DoQylidzCokGwJVGzQe1nZHR1u/af0Vz2nvPa1/Ls8CvcvloCePLnr9iYaG4dwUcTOyvNF4KlT/DD7dpaRkx2hqwCMhbtPa+wQpSalpUDrxn+OmldvcIIuRiYJcEFa7IIPRLoTZaWYKxsxlmuPPNODQSqst/MROw5ge0= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZGToRRtXYY7nBWqLfMTHCHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wLmpQodXZhP6M/UPrO1sZzkDbgjYlAG3g8l65nVd0/CBUxKQ7KDJYrtX0vSmnFXg/ykfgtJNiwqfCnqbr85+BisLEgkUHB6eL1/zU2ROshGthYOlrXBift/BGCEdEbtydK4o24b6bsY7hyY4zV2QKiqZRuTRsqAVO9JIUJp5FtwNQoBRPKnKw+CO5XALafi2Epg65rLQ3qxA5KyA70ZizpABFF3vTLNeat1xAZaHRCRliKfznQ1kfgN39ImRrf9yyrQR1nkLIqlsaw7HIYVcjpKTe2fFccJcA8PyhNj39SQ2/C2KZUErLtf0jsBdBMMpGrHpcOL7+fRYUP+Ik= ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/cb99ace73fd0ad8

Signatures

  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab
  • suricata: ET MALWARE [eSentire] Win32/GandCrab v4/5 Ransomware CnC Activity

    suricata: ET MALWARE [eSentire] Win32/GandCrab v4/5 Ransomware CnC Activity

    suricata
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Executes dropped EXE 1 IoCs
  • Modifies extensions of user files 3 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 30 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 33 IoCs
    adwarespyware
  • Modifies system certificate store 2 TTPs 11 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 44 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\db2884a9012cf6e8ea5b3fabb0d02a9487eb412e75085b37188d5e8f4ada7ca9.exe
    "C:\Users\Admin\AppData\Local\Temp\db2884a9012cf6e8ea5b3fabb0d02a9487eb412e75085b37188d5e8f4ada7ca9.exe"
    1⤵
    • Modifies extensions of user files
    • Loads dropped DLL
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Checks processor information in registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:956
    • C:\Users\Admin\AppData\Local\Temp\db2884a9012cf6e8ea5b3fabb0d02a9487eb412e75085b37188d5e8f4ada7ca9mgr.exe
      C:\Users\Admin\AppData\Local\Temp\db2884a9012cf6e8ea5b3fabb0d02a9487eb412e75085b37188d5e8f4ada7ca9mgr.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:1648
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:532
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:532 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1340
    • C:\Windows\SysWOW64\wbem\wmic.exe
      "C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1408
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:544

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

1
T1107

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

3
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    MD5

    3ec1519968b754aaa9a783bb99482dec

    SHA1

    babb497779892eb6e546e29c3bc97b8aa87589f3

    SHA256

    da35a16953a78784a2aa6dd938277a93d58250b696ab4652a8d05240ebad95d1

    SHA512

    c3275573da57ea0ca273c33db6f698da78cc5dd2d45e80c11a5b1ce3b6a01b422bea69da6266c316ca16fff840a542e98f9db8f3f3d7e7bd4b22d35a0681db60

    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
    MD5

    954929ce43b4c392785a78f019f358aa

    SHA1

    caa737db152a97e78d684f33578dc347f5e42ee9

    SHA256

    73faad6026652a3d53a08627aa9be2260345ca029b31eafcc265a27025fa3de0

    SHA512

    a06649e32d9db4a55ba14f21c1715058588b1cc820ac9cd7ce59a75fbe894f00fbcf51a54d742390940cc722fae120f6dd9cf7ee848c4f53effc3fe988d3c64a

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\db2884a9012cf6e8ea5b3fabb0d02a9487eb412e75085b37188d5e8f4ada7ca9mgr.exe
    MD5

    53879f5fd7af722a70627f9e4b5adce5

    SHA1

    69de5fa9e86e2c7925a1a2b99fd8afca5f490297

    SHA256

    db2ac1b0d85aef160b4bdab57c3ebe3fb53eec7345ef703bc1a328f803ea3075

    SHA512

    d354a713c6912cec8df4203a69bc048a267ed3b357e1cb24aa96f6d910e1c96a946f8ea82524c0253f2395727efadc55c6672ebf0b0dac66dc4872d2161f55bc

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\KRAB-DECRYPT.txt
    MD5

    afcd9fdacd2991fd25ec06dd757d4ef5

    SHA1

    955df6950e161275f94bb70a01cf550271f1bdee

    SHA256

    28bc4114d45a1ccd76a4d42dd82cd5714048b197ab01f36ebfb6fc17bb5f1c27

    SHA512

    dc242357b51c38aafbcb0294ceff17a0fba2f353895091bb274c05317a3b7d7017b68443fa9342b7914e54c5d8db423ee17b2e796084df3d72998bd12a7d6e9a

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\KRAB-DECRYPT.txt
    MD5

    afcd9fdacd2991fd25ec06dd757d4ef5

    SHA1

    955df6950e161275f94bb70a01cf550271f1bdee

    SHA256

    28bc4114d45a1ccd76a4d42dd82cd5714048b197ab01f36ebfb6fc17bb5f1c27

    SHA512

    dc242357b51c38aafbcb0294ceff17a0fba2f353895091bb274c05317a3b7d7017b68443fa9342b7914e54c5d8db423ee17b2e796084df3d72998bd12a7d6e9a

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\KRAB-DECRYPT.txt
    MD5

    afcd9fdacd2991fd25ec06dd757d4ef5

    SHA1

    955df6950e161275f94bb70a01cf550271f1bdee

    SHA256

    28bc4114d45a1ccd76a4d42dd82cd5714048b197ab01f36ebfb6fc17bb5f1c27

    SHA512

    dc242357b51c38aafbcb0294ceff17a0fba2f353895091bb274c05317a3b7d7017b68443fa9342b7914e54c5d8db423ee17b2e796084df3d72998bd12a7d6e9a

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\U9JYTBEA.txt
    MD5

    fa6cf5b56236f60e99c58e186b470257

    SHA1

    c6ea9caa04c8883de0d3cd828239d8d6729b2207

    SHA256

    a13b9ea6003f6cc1ff564549a1194ad7920817cea9e7fb3fe3f0b91fe81f2294

    SHA512

    2aea899c4471c9e247965c1abff31466421928a867535e0a4a1bbd2005eb2a79c3093aa3250925fe017823a3f55e913c2ac9f15ff68e8aa0e7f7c45b9ee2039a

    Download Submit
  • \Users\Admin\AppData\Local\Temp\db2884a9012cf6e8ea5b3fabb0d02a9487eb412e75085b37188d5e8f4ada7ca9mgr.exe
    MD5

    53879f5fd7af722a70627f9e4b5adce5

    SHA1

    69de5fa9e86e2c7925a1a2b99fd8afca5f490297

    SHA256

    db2ac1b0d85aef160b4bdab57c3ebe3fb53eec7345ef703bc1a328f803ea3075

    SHA512

    d354a713c6912cec8df4203a69bc048a267ed3b357e1cb24aa96f6d910e1c96a946f8ea82524c0253f2395727efadc55c6672ebf0b0dac66dc4872d2161f55bc

    Download Submit
  • \Users\Admin\AppData\Local\Temp\db2884a9012cf6e8ea5b3fabb0d02a9487eb412e75085b37188d5e8f4ada7ca9mgr.exe
    MD5

    53879f5fd7af722a70627f9e4b5adce5

    SHA1

    69de5fa9e86e2c7925a1a2b99fd8afca5f490297

    SHA256

    db2ac1b0d85aef160b4bdab57c3ebe3fb53eec7345ef703bc1a328f803ea3075

    SHA512

    d354a713c6912cec8df4203a69bc048a267ed3b357e1cb24aa96f6d910e1c96a946f8ea82524c0253f2395727efadc55c6672ebf0b0dac66dc4872d2161f55bc

    Download Submit
  • memory/956-55-0x00000000763B1000-0x00000000763B3000-memory.dmp
    Filesize

    8KB

    Download
  • memory/956-71-0x0000000000080000-0x0000000000092000-memory.dmp
    Filesize

    72KB

    Download
  • memory/1648-59-0x0000000000400000-0x0000000000412000-memory.dmp
    Filesize

    72KB

    Download
  • memory/1648-64-0x0000000000400000-0x0000000000412000-memory.dmp
    Filesize

    72KB

    Download
  • memory/1648-63-0x0000000000190000-0x0000000000191000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1648-62-0x0000000000400000-0x000000000041A000-memory.dmp
    Filesize

    104KB

    Download
  • memory/1648-61-0x0000000000400000-0x000000000041A000-memory.dmp
    Filesize

    104KB

    Download
  • memory/1648-60-0x0000000000410000-0x0000000000419000-memory.dmp
    Filesize

    36KB

    Download