Overview

overview

10

Static

static

2d9daac791...ec.exe

windows7_x64

10

2d9daac791...ec.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2d9daac7915ae801cd4567531c63762cc7be7c92fab458be1122a8fc637a42ec

  • Size

    256KB

  • Sample

    220622-rwcqzabef5

  • MD5

    e435ada682452154c0929068fa84f587

  • SHA1

    4b46b7f352d5049f39e965f019c04f2ab07ad0f0

  • SHA256

    2d9daac7915ae801cd4567531c63762cc7be7c92fab458be1122a8fc637a42ec

  • SHA512

    b2d53406b655a470e250d6beb1a59ae5b62131775f01519beafea9cdcd9420bae8b2f897055c953cb441afeda90db0815f68ad9abef724ab0b37806603a9620d

Score
10/10
gandcrabbackdoorpersistenceransomwaresuricata

Malware Config

Targets

    • Target

      2d9daac7915ae801cd4567531c63762cc7be7c92fab458be1122a8fc637a42ec

    • Size

      256KB

    • MD5

      e435ada682452154c0929068fa84f587

    • SHA1

      4b46b7f352d5049f39e965f019c04f2ab07ad0f0

    • SHA256

      2d9daac7915ae801cd4567531c63762cc7be7c92fab458be1122a8fc637a42ec

    • SHA512

      b2d53406b655a470e250d6beb1a59ae5b62131775f01519beafea9cdcd9420bae8b2f897055c953cb441afeda90db0815f68ad9abef724ab0b37806603a9620d

    Score
    10/10
    gandcrabbackdoorpersistenceransomwaresuricata

    • GandCrab Payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • suricata: ET MALWARE Observed GandCrab Ransomware Domain (carder .bit in DNS Lookup)

      suricata: ET MALWARE Observed GandCrab Ransomware Domain (carder .bit in DNS Lookup)

      suricata

    • suricata: ET MALWARE Observed GandCrab Ransomware Domain (ransomware .bit in DNS Lookup)

      suricata: ET MALWARE Observed GandCrab Ransomware Domain (ransomware .bit in DNS Lookup)

      suricata

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks