gandcrab | 3732c9fd5ff38c31fda2492dd81584819f12cce5731f7361f536bdf8040c724d | Triage

Analysis

max time kernel
141s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
26-06-2022 00:07

Sharing

Report Analysis Logs

General

Target

3732c9fd5ff38c31fda2492dd81584819f12cce5731f7361f536bdf8040c724d.exe
Size

254KB
MD5

cf85b692e58a94538052047ccaaad006
SHA1

08c9f04c1002311ae51671427be6994ed604e797
SHA256

3732c9fd5ff38c31fda2492dd81584819f12cce5731f7361f536bdf8040c724d
SHA512

f60270cac39e9cc6f1ebb88bfb47a4b8001962c91e4797d9898556eea51e82e5163dc6207cadeaa008a10b54c9e99178f062ce17164364810591f6d1d786a040

Score

10^/10

gandcrab backdoor ransomware

Malware Config

Signatures

GandCrab Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2576-131-0x0000000000400000-0x0000000000447000-memory.dmp	family_gandcrab
behavioral2/memory/2576-133-0x00000000004E0000-0x0000000000504000-memory.dmp	family_gandcrab

Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4616 2576 WerFault.exe 3732c9fd5ff38c31fda2492dd81584819f12cce5731f7361f536bdf8040c724d.exe

C:\Users\Admin\AppData\Local\Temp\3732c9fd5ff38c31fda2492dd81584819f12cce5731f7361f536bdf8040c724d.exe
"C:\Users\Admin\AppData\Local\Temp\3732c9fd5ff38c31fda2492dd81584819f12cce5731f7361f536bdf8040c724d.exe"
1⤵
PID:2576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 352
2⤵
- Program crash
PID:4616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2576 -ip 2576
1⤵
PID:4188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2576-130-0x000000000055D000-0x000000000057C000-memory.dmp

Filesize
124KB

Download
memory/2576-131-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2576-133-0x00000000004E0000-0x0000000000504000-memory.dmp

Filesize
144KB

Download
memory/2576-134-0x000000000055D000-0x000000000057C000-memory.dmp

Filesize
124KB

Download