gandcrab | 36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15

General

Target

36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
Size

313KB
MD5

541aa6e73a72f2b169163c4f167ce653
SHA1

380e38fb4a4c56cbaa5c14a26ec433ce56691414
SHA256

36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15
SHA512

c0db6d75d14c8237c1631e2d1620f5125c2e8ac8d902c778d4b36d78e6824d895642f49e5bb904fbec92352df454f91e49b437f90af2d4625e0aa4d6576d47aa

Score

10^/10

gandcrab backdoor ransomware

Malware Config

Signatures

GandCrab Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3684-130-0x0000000000400000-0x0000000003B9F000-memory.dmp	family_gandcrab
behavioral2/memory/3684-133-0x00000000057D0000-0x00000000057E7000-memory.dmp	family_gandcrab
behavioral2/memory/3684-134-0x0000000000400000-0x0000000003B9F000-memory.dmp	family_gandcrab

Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4940 3684 WerFault.exe 36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe

pid	pid_target	process	target process
4940	3684	WerFault.exe	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe

Suspicious use of SetWindowsHookAW 64 IoCs

Processes:

36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe

pid	process
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
3684	36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe

C:\Users\Admin\AppData\Local\Temp\36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe
"C:\Users\Admin\AppData\Local\Temp\36fdeb2abf80269259078d51391f9fcf224f262107bc0d6194e37dd021237b15.exe"
1⤵
- Suspicious use of SetWindowsHookAW
PID:3684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3684 -s 468
2⤵
- Program crash
PID:4940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3684 -ip 3684
1⤵
PID:3344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3684-131-0x0000000005790000-0x00000000057AB000-memory.dmp

Filesize
108KB

Download
memory/3684-130-0x0000000000400000-0x0000000003B9F000-memory.dmp

Filesize
55.6MB

Download
memory/3684-133-0x00000000057D0000-0x00000000057E7000-memory.dmp

Filesize
92KB

Download
memory/3684-134-0x0000000000400000-0x0000000003B9F000-memory.dmp

Filesize
55.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads