Overview

overview

10

Static

static

10

4aab275b33...9f.exe

windows7_x64

10

4aab275b33...9f.exe

windows10_x64

10

Analysis

  • max time kernel
    163s
  • max time network
    180s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    28-01-2022 21:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4aab275b3318ccc3432c065561a1911c7f7b9d3b5d7aa7ec1d8e5bffa6c7409f.exe

  • Size

    192KB

  • MD5

    2e99d80a8b6534a2604d5ea918a3879e

  • SHA1

    be0101b10243aa75b4d003a8eb47c2c06aa32cb2

  • SHA256

    4aab275b3318ccc3432c065561a1911c7f7b9d3b5d7aa7ec1d8e5bffa6c7409f

  • SHA512

    71ae3aecee68777b324d36b1850bd14cab244290232584d4d7d6ce1ab276e5540ac12d3bfe3fde5d411ba201e7062e067e914b12e311adaaf4aaa59f590f2d46

Score
10/10
gandcrabbackdoorransomwarespywarestealerupx

Malware Config

Extracted

Path

C:\KRAB-DECRYPT.txt

Ransom Note
---= GANDCRAB V4 =--- Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .KRAB The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/5775be967041606 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAEJesQTpnaqr/v/fgRJgW/qNkp6ygraL1mE2Ktxp7B4u7PDsWJrMGcF45g36c61SECIWZwplCrfydt1gP/MA7UOJiwCmNGpVVy3bS4h2RBUJpuaUbSDrleQNz9idOCH+sowbnwBCEhsheRNuJ/epF8Re9a1CfZIkE+FzXR15k8uA39VuSGduwY9mTYRXA1E/XrRBoFoxnC4lYsEe72rwEF6ouPDgVKMCagNDVjINGVKSoMZOPt6ihwVLt0S7+vhTWcN+POVKZuGt5dXTJ4W6quCe89eMnjgnK6oME7mM7MT3kyBVdvhbZ1xP8nN1J475jxrBpegZu4LIoTLmTCI6Yg/fixjZyOaa0M0sOr4XU5i5DACXzJyXXGnkRNIENFg3q/4i2dJZnV73ojDPlxa+H/VWA/JD5D9OlgJVLW1bCBe2GRL+pdpkHn+Cnhx8hUHi+ye4f3I1QTeo4UvnROmMZYvrI0+Vew6PHvr95j1TORZVe20YnurSP7Pgfvray2gUHu4TDw1GObSr3Jtgef/YklGj7670Fk94OTGIZovv8zWHdvf/6xI4LOfyFNvjM59O51wL/wpXd4ReSsZNNFNx8zXebPnskq9cbdAclpPM7UYIgq7K1vaArckQAohGPYzHTXk2y3Nb0C9LtHuaa6V/OKCWmbbmVsvaVuPJhjCncDZ32QyQPQGoWSK5OQ63/ArVkv54FyeBJDLl7q6OI9JDm45zzP9aZDXPyrsDKPKMgv0maBgRiHcmpr+AeD06xV5Y5Gm2efIZjnqsyFU6mV61WzU5xEmK/BumHkywtysHPhv/ouTEtthB3aME/gCIYrETFRR9leuETnkk+Di+M7iUfNPJ5U2DjYQk397nFDsbW43aMJ0MCd8NbmOwl6xuAj9bovoh72zwfHY3+ulTElBRMFM8sIozASqo9TNBSNdf1UAffI7c1pMOlO7ycoMjFlKQe632Br/NFDkrfIuG2fifbWZ9zrYYJ03uiPh9b0Yd59K0APlYrK9waGM2S/Vdb4c8i0d9JmMtKwdZrYDnEf7QR3gK7FDcEu/bt8j+csERcmcAfzUu7cuibaIxA9YE6xCA5eeqtBQvz/8HUSt6OBz66Dhu8GJHu0FbzEv5WcNjuc31vDCymEyWqTzvXSDnM9ipyLg2PesGkm6ArICWcAjy65+6ajWDc/dTX/wPQKb0WwnijIXpD5vDaVso+9jkqgng2H9gGDAHSlXQk2ypUBXPDIEUWwzPSMhsUNzD4ikd3LrkvK0gjbL9/JFmXZN+np1NDfKlOyU2U8zZi09sXbKF2d7CqB4rJ/Xe1vm3uKMGoc9HLdMoSTgqt+vuBn0UiiR5vRiRUXonAgj0GAYo9Gu+VzWOAQz6KK74S9jHTHu/A2RhBUzM/s5hgDaLbaHPYBeS5SWgTx5uwxCGoVTZm2JlWg07We7KHQOSyu3evY9pn65vWuxp+Lo09ec29VW1aFaj2ptwIoYu7n147nij+oScGpDdnrTNBwbUVnLO97zHA/MgAnC6YPiJv+GoTM39ScQope12QaFmxBrY3TOzp3x6ZS+S4MWrBWKPDqLOysKtXoB5X/uTqfW+yEnBgBL04XqbWPHWkEbtFv3Dm0DJ7ebf/TkDUlbEm491JShe3y+yZJpZxvMEH31HgkB9Oxze2bt1uheaXa9VbQm6kdNGpc/I0QmuPOL6px+AUj4mbflDo/1GwbyLXrVgWxlj0fzLfX0U3xMkOKt26xQ7kX/cy43q7IBRnx3hcnVEXBaXPliI1tC+8RiTOub52COJHITX1mJZH+di2sMFi9Spb8uefS8Q/A7iDWv9gtD2U5h9RTl+eUgDLSbC18BLm4sOScQBSXko0APXMaOt5VuvvON9FDgDPxQ95RHBzvWjQFdhtP//KtZh7+37rf4ubUcX+tklXTAhmqRNbXayhSr74iHN2nxuRF71D8slSKY1XXnVYwZaRNowaBk2oPRvzRm8Yw/bzZ0lKsxEOZMiUxL1hfzQJcfghde60rLIyPJQGbqlKM8gFbujIZ3WCQ6Bi62OLzUU926V+BiQnbqHLuhARqhpXPl4psZlREXbHI0vLp3g9Vr8SV92fhzP7CcOkDMt2rRqOi89sPIGdEkYmPLEKv2SHcS/oLcR9MaNDtLjGyBCA/Nw1mvHLj/eZu+MZdlBueyp4fpcf8hg7qQ0FzRE58dc+rM42IXG8UK5ra8g4CpPHus7B6V7cpz+/MTedwOApdBMJarrgu9q+9M= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZaTp9RtXYU7nBWsLfMTGiHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wNmoQoAHZdP6U/VvqF1shzlzbajc1AHXg7l8xnT91gCFUxMg7ADMEr7316SnTFUg/DkeItL9jgqZqn97qv5+hisbEnkUHB5uKj/2Y2FesnGt1YbFqFBjHt9RGCEY0brCdh4tO4TaaYY6NyHIzX2RSiw5QcTWsqa1O5JIMJoZFrwNAoDBPBnKk+Fe5dALqfjmE2g6RrLQ3pxA5Kww7wZijpDxFb3qzLZeak1w8ZOHQARhaKOTmD1j7gLX9ZmUXfnSzyQU5ni7JolpqwqXJNVdfpIzeqfBkceMB9P3VNlH8HQyLCn6YbErztckilBdpMPJGpHsYO ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/5775be967041606

Signatures

  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Executes dropped EXE 1 IoCs
  • Modifies extensions of user files 9 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops startup file 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 35 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 14 IoCs
    adwarespyware
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4aab275b3318ccc3432c065561a1911c7f7b9d3b5d7aa7ec1d8e5bffa6c7409f.exe
    "C:\Users\Admin\AppData\Local\Temp\4aab275b3318ccc3432c065561a1911c7f7b9d3b5d7aa7ec1d8e5bffa6c7409f.exe"
    1⤵
    • Modifies extensions of user files
    • Drops startup file
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Checks processor information in registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1560
    • C:\Users\Admin\AppData\Local\Temp\4aab275b3318ccc3432c065561a1911c7f7b9d3b5d7aa7ec1d8e5bffa6c7409fmgr.exe
      C:\Users\Admin\AppData\Local\Temp\4aab275b3318ccc3432c065561a1911c7f7b9d3b5d7aa7ec1d8e5bffa6c7409fmgr.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:1484
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3548
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3548 CREDAT:82945 /prefetch:2
          4⤵
            PID:3308
      • C:\Windows\SysWOW64\wbem\wmic.exe
        "C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1740
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3948

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    File Deletion

    1
    T1107

    Modify Registry

    2
    T1112

    Install Root Certificate

    1
    T1130

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    Query Registry

    2
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    3
    T1082

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Exfiltration

    Command and Control

    Impact

    Inhibit System Recovery

    1
    T1490

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\4aab275b3318ccc3432c065561a1911c7f7b9d3b5d7aa7ec1d8e5bffa6c7409fmgr.exe
      MD5

      53879f5fd7af722a70627f9e4b5adce5

      SHA1

      69de5fa9e86e2c7925a1a2b99fd8afca5f490297

      SHA256

      db2ac1b0d85aef160b4bdab57c3ebe3fb53eec7345ef703bc1a328f803ea3075

      SHA512

      d354a713c6912cec8df4203a69bc048a267ed3b357e1cb24aa96f6d910e1c96a946f8ea82524c0253f2395727efadc55c6672ebf0b0dac66dc4872d2161f55bc

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\4aab275b3318ccc3432c065561a1911c7f7b9d3b5d7aa7ec1d8e5bffa6c7409fmgr.exe
      MD5

      53879f5fd7af722a70627f9e4b5adce5

      SHA1

      69de5fa9e86e2c7925a1a2b99fd8afca5f490297

      SHA256

      db2ac1b0d85aef160b4bdab57c3ebe3fb53eec7345ef703bc1a328f803ea3075

      SHA512

      d354a713c6912cec8df4203a69bc048a267ed3b357e1cb24aa96f6d910e1c96a946f8ea82524c0253f2395727efadc55c6672ebf0b0dac66dc4872d2161f55bc

      Download Submit
    • memory/1484-121-0x0000000000410000-0x0000000000419000-memory.dmp
      Filesize

      36KB

      Download
    • memory/1484-122-0x0000000000400000-0x000000000041A000-memory.dmp
      Filesize

      104KB

      Download
    • memory/1484-120-0x0000000000400000-0x0000000000412000-memory.dmp
      Filesize

      72KB

      Download
    • memory/1484-123-0x0000000000400000-0x000000000041A000-memory.dmp
      Filesize

      104KB

      Download
    • memory/1484-124-0x0000000000060000-0x0000000000061000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1484-125-0x0000000000400000-0x0000000000412000-memory.dmp
      Filesize

      72KB

      Download