gandcrab | 2d9daac7915ae801cd4567531c63762cc7be7c92fab458be1122a8fc637a42ec | Triage

Analysis

max time kernel
94s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
22-06-2022 14:32

Sharing

Report Analysis Logs

General

Target

2d9daac7915ae801cd4567531c63762cc7be7c92fab458be1122a8fc637a42ec.exe
Size

256KB
MD5

e435ada682452154c0929068fa84f587
SHA1

4b46b7f352d5049f39e965f019c04f2ab07ad0f0
SHA256

2d9daac7915ae801cd4567531c63762cc7be7c92fab458be1122a8fc637a42ec
SHA512

b2d53406b655a470e250d6beb1a59ae5b62131775f01519beafea9cdcd9420bae8b2f897055c953cb441afeda90db0815f68ad9abef724ab0b37806603a9620d

Score

10^/10

gandcrab backdoor ransomware

Malware Config

Signatures

GandCrab Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3992-132-0x0000000000400000-0x000000000048A000-memory.dmp	family_gandcrab
behavioral2/memory/3992-134-0x0000000002210000-0x0000000002227000-memory.dmp	family_gandcrab

Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3312 3992 WerFault.exe 2d9daac7915ae801cd4567531c63762cc7be7c92fab458be1122a8fc637a42ec.exe

C:\Users\Admin\AppData\Local\Temp\2d9daac7915ae801cd4567531c63762cc7be7c92fab458be1122a8fc637a42ec.exe
"C:\Users\Admin\AppData\Local\Temp\2d9daac7915ae801cd4567531c63762cc7be7c92fab458be1122a8fc637a42ec.exe"
1⤵
PID:3992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 400
2⤵
- Program crash
PID:3312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3992 -ip 3992
1⤵
PID:3984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3992-130-0x00000000021C0000-0x00000000021DB000-memory.dmp

Filesize
108KB

Download
memory/3992-131-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3992-132-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3992-134-0x0000000002210000-0x0000000002227000-memory.dmp

Filesize
92KB

Download