Analysis
-
max time kernel
132s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
26-06-2022 23:23
Static task
static1
Behavioral task
behavioral1
Sample
35b0298974f6d451c37a398a000585dab8d7412495af32a1f8b4b16eb30859c1.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
35b0298974f6d451c37a398a000585dab8d7412495af32a1f8b4b16eb30859c1.exe
Resource
win10v2004-20220414-en
General
-
Target
35b0298974f6d451c37a398a000585dab8d7412495af32a1f8b4b16eb30859c1.exe
-
Size
294KB
-
MD5
84714b6adb4f45377a6a8dcd6e678a20
-
SHA1
d9057c0cdfd576f2ee9e1eb73bc7a121de213687
-
SHA256
35b0298974f6d451c37a398a000585dab8d7412495af32a1f8b4b16eb30859c1
-
SHA512
9062aba5fe381e458dc21bbe8437c52b7a05d0cd1f14ccefb41196d23250d52331a9d24a3eb2fade6f49a8cd99fc88ab3c935c7e56d148e943392716c8a1919a
Malware Config
Signatures
-
GandCrab Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3116-132-0x0000000000400000-0x0000000005AA4000-memory.dmp family_gandcrab behavioral2/memory/3116-135-0x0000000005C00000-0x0000000005C17000-memory.dmp family_gandcrab behavioral2/memory/3116-136-0x0000000000400000-0x0000000005AA4000-memory.dmp family_gandcrab -
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3292 3116 WerFault.exe 35b0298974f6d451c37a398a000585dab8d7412495af32a1f8b4b16eb30859c1.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
35b0298974f6d451c37a398a000585dab8d7412495af32a1f8b4b16eb30859c1.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 35b0298974f6d451c37a398a000585dab8d7412495af32a1f8b4b16eb30859c1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 35b0298974f6d451c37a398a000585dab8d7412495af32a1f8b4b16eb30859c1.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
35b0298974f6d451c37a398a000585dab8d7412495af32a1f8b4b16eb30859c1.exedescription pid process target process PID 3116 wrote to memory of 5028 3116 35b0298974f6d451c37a398a000585dab8d7412495af32a1f8b4b16eb30859c1.exe splwow64.exe PID 3116 wrote to memory of 5028 3116 35b0298974f6d451c37a398a000585dab8d7412495af32a1f8b4b16eb30859c1.exe splwow64.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\35b0298974f6d451c37a398a000585dab8d7412495af32a1f8b4b16eb30859c1.exe"C:\Users\Admin\AppData\Local\Temp\35b0298974f6d451c37a398a000585dab8d7412495af32a1f8b4b16eb30859c1.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 4202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3116 -ip 31161⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3116-130-0x0000000005C3D000-0x0000000005C56000-memory.dmpFilesize
100KB
-
memory/3116-133-0x0000000005C3D000-0x0000000005C56000-memory.dmpFilesize
100KB
-
memory/3116-132-0x0000000000400000-0x0000000005AA4000-memory.dmpFilesize
86.6MB
-
memory/3116-135-0x0000000005C00000-0x0000000005C17000-memory.dmpFilesize
92KB
-
memory/3116-136-0x0000000000400000-0x0000000005AA4000-memory.dmpFilesize
86.6MB
-
memory/5028-131-0x0000000000000000-mapping.dmp