gandcrab | 3d2eb2c3b8340f23e9430adc1520a663454d78a58123397306c1299278182b61 | Triage

Analysis

max time kernel
153s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
03-07-2022 03:58

Sharing

Report Analysis Logs

General

Target

3d2eb2c3b8340f23e9430adc1520a663454d78a58123397306c1299278182b61.exe
Size

212KB
MD5

a82d5bbfb026a00283a6fab1d4c530dc
SHA1

8974d9525d2b88d9f2a6ef26852f4afe63e6df04
SHA256

3d2eb2c3b8340f23e9430adc1520a663454d78a58123397306c1299278182b61
SHA512

5c73e2b419b9bc277a18fd49a54574f083c8e9d478caf3ad5bd02891ec449539bbcb5ffd96935ccd9e3c0d7b87a975ed6d655835f2fbd6dc1cde097802fd722e

Score

10^/10

gandcrab backdoor ransomware

Malware Config

Signatures

GandCrab Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1468-130-0x0000000000400000-0x0000000000480000-memory.dmp	family_gandcrab
behavioral2/memory/1468-133-0x0000000000400000-0x0000000000480000-memory.dmp	family_gandcrab
behavioral2/memory/1468-134-0x00000000006F0000-0x0000000000707000-memory.dmp	family_gandcrab

Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2524 1468 WerFault.exe 3d2eb2c3b8340f23e9430adc1520a663454d78a58123397306c1299278182b61.exe

C:\Users\Admin\AppData\Local\Temp\3d2eb2c3b8340f23e9430adc1520a663454d78a58123397306c1299278182b61.exe
"C:\Users\Admin\AppData\Local\Temp\3d2eb2c3b8340f23e9430adc1520a663454d78a58123397306c1299278182b61.exe"
1⤵
PID:1468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 468
2⤵
- Program crash
PID:2524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1468 -ip 1468
1⤵
PID:4308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1468-130-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1468-132-0x000000000072F000-0x000000000074B000-memory.dmp

Filesize
112KB

Download
memory/1468-133-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1468-134-0x00000000006F0000-0x0000000000707000-memory.dmp

Filesize
92KB

Download