Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    08-07-2022 04:41

General

  • Target

    41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe

  • Size

    231KB

  • MD5

    1d364a0c31c32d46b5efe2598125818f

  • SHA1

    11404f54bd4a3168a152b9af177f13bc481fa576

  • SHA256

    41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf

  • SHA512

    3e39a071666b0f6c00c86a445e401898b22bf2de99e8c632a89032364620acef8bc016dce0bd522172421f1b97197ef7e673c4e840b41c37ca4a029753c82fe8

Malware Config

Signatures

  • GandCrab payload 4 IoCs
  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

  • suricata: ET MALWARE Observed GandCrab Ransomware Domain (carder .bit in DNS Lookup)

    suricata: ET MALWARE Observed GandCrab Ransomware Domain (carder .bit in DNS Lookup)

  • suricata: ET MALWARE Observed GandCrab Ransomware Domain (ransomware .bit in DNS Lookup)

    suricata: ET MALWARE Observed GandCrab Ransomware Domain (ransomware .bit in DNS Lookup)

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 60 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe
    "C:\Users\Admin\AppData\Local\Temp\41c35a69a2313fec2dbf6b2ba8813a5e3ee3adf6a48491ca2b7b9a0110e54adf.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in Windows directory
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1612
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      2⤵
        PID:1688
      • C:\Windows\SysWOW64\nslookup.exe
        nslookup ransomware.bit ns2.wowservers.ru
        2⤵
          PID:1152
        • C:\Windows\SysWOW64\nslookup.exe
          nslookup carder.bit ns2.wowservers.ru
          2⤵
            PID:1188
          • C:\Windows\SysWOW64\nslookup.exe
            nslookup ransomware.bit ns1.wowservers.ru
            2⤵
              PID:1108
            • C:\Windows\SysWOW64\nslookup.exe
              nslookup carder.bit ns1.wowservers.ru
              2⤵
                PID:1556
              • C:\Windows\SysWOW64\nslookup.exe
                nslookup ransomware.bit ns2.wowservers.ru
                2⤵
                  PID:1692
                • C:\Windows\SysWOW64\nslookup.exe
                  nslookup carder.bit ns2.wowservers.ru
                  2⤵
                    PID:1068
                  • C:\Windows\SysWOW64\nslookup.exe
                    nslookup ransomware.bit ns1.wowservers.ru
                    2⤵
                      PID:684
                    • C:\Windows\SysWOW64\nslookup.exe
                      nslookup carder.bit ns1.wowservers.ru
                      2⤵
                        PID:920
                      • C:\Windows\SysWOW64\nslookup.exe
                        nslookup ransomware.bit ns2.wowservers.ru
                        2⤵
                          PID:832
                        • C:\Windows\SysWOW64\nslookup.exe
                          nslookup carder.bit ns2.wowservers.ru
                          2⤵
                            PID:1380
                          • C:\Windows\SysWOW64\nslookup.exe
                            nslookup ransomware.bit ns1.wowservers.ru
                            2⤵
                              PID:1244
                            • C:\Windows\SysWOW64\nslookup.exe
                              nslookup carder.bit ns1.wowservers.ru
                              2⤵
                                PID:1116
                              • C:\Windows\SysWOW64\nslookup.exe
                                nslookup ransomware.bit ns2.wowservers.ru
                                2⤵
                                  PID:1240
                                • C:\Windows\SysWOW64\nslookup.exe
                                  nslookup carder.bit ns2.wowservers.ru
                                  2⤵
                                    PID:1708
                                  • C:\Windows\SysWOW64\nslookup.exe
                                    nslookup ransomware.bit ns1.wowservers.ru
                                    2⤵
                                      PID:1736
                                    • C:\Windows\SysWOW64\nslookup.exe
                                      nslookup carder.bit ns1.wowservers.ru
                                      2⤵
                                        PID:1332
                                      • C:\Windows\SysWOW64\nslookup.exe
                                        nslookup ransomware.bit ns2.wowservers.ru
                                        2⤵
                                          PID:472
                                        • C:\Windows\SysWOW64\nslookup.exe
                                          nslookup carder.bit ns2.wowservers.ru
                                          2⤵
                                            PID:912
                                          • C:\Windows\SysWOW64\nslookup.exe
                                            nslookup ransomware.bit ns1.wowservers.ru
                                            2⤵
                                              PID:1540
                                            • C:\Windows\SysWOW64\nslookup.exe
                                              nslookup carder.bit ns1.wowservers.ru
                                              2⤵
                                                PID:1944
                                              • C:\Windows\SysWOW64\nslookup.exe
                                                nslookup ransomware.bit ns2.wowservers.ru
                                                2⤵
                                                  PID:804
                                                • C:\Windows\SysWOW64\nslookup.exe
                                                  nslookup carder.bit ns2.wowservers.ru
                                                  2⤵
                                                    PID:568
                                                  • C:\Windows\SysWOW64\nslookup.exe
                                                    nslookup ransomware.bit ns1.wowservers.ru
                                                    2⤵
                                                      PID:1668
                                                    • C:\Windows\SysWOW64\nslookup.exe
                                                      nslookup carder.bit ns1.wowservers.ru
                                                      2⤵
                                                        PID:596
                                                      • C:\Windows\SysWOW64\nslookup.exe
                                                        nslookup ransomware.bit ns2.wowservers.ru
                                                        2⤵
                                                          PID:1352
                                                        • C:\Windows\SysWOW64\nslookup.exe
                                                          nslookup carder.bit ns2.wowservers.ru
                                                          2⤵
                                                            PID:1884
                                                          • C:\Windows\SysWOW64\nslookup.exe
                                                            nslookup ransomware.bit ns1.wowservers.ru
                                                            2⤵
                                                              PID:848
                                                            • C:\Windows\SysWOW64\nslookup.exe
                                                              nslookup carder.bit ns1.wowservers.ru
                                                              2⤵
                                                                PID:1600
                                                              • C:\Windows\SysWOW64\nslookup.exe
                                                                nslookup ransomware.bit ns2.wowservers.ru
                                                                2⤵
                                                                  PID:1264
                                                                • C:\Windows\SysWOW64\nslookup.exe
                                                                  nslookup carder.bit ns2.wowservers.ru
                                                                  2⤵
                                                                    PID:1548
                                                                  • C:\Windows\SysWOW64\nslookup.exe
                                                                    nslookup ransomware.bit ns1.wowservers.ru
                                                                    2⤵
                                                                      PID:1528
                                                                    • C:\Windows\SysWOW64\nslookup.exe
                                                                      nslookup carder.bit ns1.wowservers.ru
                                                                      2⤵
                                                                        PID:1936
                                                                      • C:\Windows\SysWOW64\nslookup.exe
                                                                        nslookup ransomware.bit ns2.wowservers.ru
                                                                        2⤵
                                                                          PID:384
                                                                        • C:\Windows\SysWOW64\nslookup.exe
                                                                          nslookup carder.bit ns2.wowservers.ru
                                                                          2⤵
                                                                            PID:1728
                                                                          • C:\Windows\SysWOW64\nslookup.exe
                                                                            nslookup ransomware.bit ns1.wowservers.ru
                                                                            2⤵
                                                                              PID:1724
                                                                            • C:\Windows\SysWOW64\nslookup.exe
                                                                              nslookup carder.bit ns1.wowservers.ru
                                                                              2⤵
                                                                                PID:768
                                                                              • C:\Windows\SysWOW64\nslookup.exe
                                                                                nslookup ransomware.bit ns2.wowservers.ru
                                                                                2⤵
                                                                                  PID:1748
                                                                                • C:\Windows\SysWOW64\nslookup.exe
                                                                                  nslookup carder.bit ns2.wowservers.ru
                                                                                  2⤵
                                                                                    PID:340
                                                                                  • C:\Windows\SysWOW64\nslookup.exe
                                                                                    nslookup ransomware.bit ns1.wowservers.ru
                                                                                    2⤵
                                                                                      PID:860
                                                                                    • C:\Windows\SysWOW64\nslookup.exe
                                                                                      nslookup carder.bit ns1.wowservers.ru
                                                                                      2⤵
                                                                                        PID:324
                                                                                      • C:\Windows\SysWOW64\nslookup.exe
                                                                                        nslookup ransomware.bit ns2.wowservers.ru
                                                                                        2⤵
                                                                                          PID:876
                                                                                        • C:\Windows\SysWOW64\nslookup.exe
                                                                                          nslookup carder.bit ns2.wowservers.ru
                                                                                          2⤵
                                                                                            PID:2004
                                                                                          • C:\Windows\SysWOW64\nslookup.exe
                                                                                            nslookup ransomware.bit ns1.wowservers.ru
                                                                                            2⤵
                                                                                              PID:1196
                                                                                            • C:\Windows\SysWOW64\nslookup.exe
                                                                                              nslookup carder.bit ns1.wowservers.ru
                                                                                              2⤵
                                                                                                PID:1524
                                                                                              • C:\Windows\SysWOW64\nslookup.exe
                                                                                                nslookup ransomware.bit ns2.wowservers.ru
                                                                                                2⤵
                                                                                                  PID:1840
                                                                                                • C:\Windows\SysWOW64\nslookup.exe
                                                                                                  nslookup carder.bit ns2.wowservers.ru
                                                                                                  2⤵
                                                                                                    PID:1084
                                                                                                  • C:\Windows\SysWOW64\nslookup.exe
                                                                                                    nslookup ransomware.bit ns1.wowservers.ru
                                                                                                    2⤵
                                                                                                      PID:1568
                                                                                                    • C:\Windows\SysWOW64\nslookup.exe
                                                                                                      nslookup carder.bit ns1.wowservers.ru
                                                                                                      2⤵
                                                                                                        PID:828
                                                                                                      • C:\Windows\SysWOW64\nslookup.exe
                                                                                                        nslookup ransomware.bit ns2.wowservers.ru
                                                                                                        2⤵
                                                                                                          PID:1216
                                                                                                        • C:\Windows\SysWOW64\nslookup.exe
                                                                                                          nslookup carder.bit ns2.wowservers.ru
                                                                                                          2⤵
                                                                                                            PID:1132
                                                                                                          • C:\Windows\SysWOW64\nslookup.exe
                                                                                                            nslookup ransomware.bit ns1.wowservers.ru
                                                                                                            2⤵
                                                                                                              PID:1428
                                                                                                            • C:\Windows\SysWOW64\nslookup.exe
                                                                                                              nslookup carder.bit ns1.wowservers.ru
                                                                                                              2⤵
                                                                                                                PID:1716
                                                                                                              • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                nslookup ransomware.bit ns2.wowservers.ru
                                                                                                                2⤵
                                                                                                                  PID:456
                                                                                                                • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                  nslookup carder.bit ns2.wowservers.ru
                                                                                                                  2⤵
                                                                                                                    PID:1632
                                                                                                                  • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                    nslookup ransomware.bit ns1.wowservers.ru
                                                                                                                    2⤵
                                                                                                                      PID:1764
                                                                                                                    • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                      nslookup carder.bit ns1.wowservers.ru
                                                                                                                      2⤵
                                                                                                                        PID:1588
                                                                                                                      • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                        nslookup ransomware.bit ns2.wowservers.ru
                                                                                                                        2⤵
                                                                                                                          PID:1964
                                                                                                                        • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                          nslookup carder.bit ns2.wowservers.ru
                                                                                                                          2⤵
                                                                                                                            PID:1648
                                                                                                                          • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                            nslookup ransomware.bit ns1.wowservers.ru
                                                                                                                            2⤵
                                                                                                                              PID:896
                                                                                                                            • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                              nslookup carder.bit ns1.wowservers.ru
                                                                                                                              2⤵
                                                                                                                                PID:1756
                                                                                                                              • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                nslookup ransomware.bit ns2.wowservers.ru
                                                                                                                                2⤵
                                                                                                                                  PID:300
                                                                                                                                • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                  nslookup carder.bit ns2.wowservers.ru
                                                                                                                                  2⤵
                                                                                                                                    PID:1040

                                                                                                                                Network

                                                                                                                                MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                                Persistence

                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                1
                                                                                                                                T1060

                                                                                                                                Defense Evasion

                                                                                                                                Modify Registry

                                                                                                                                1
                                                                                                                                T1112

                                                                                                                                Discovery

                                                                                                                                Query Registry

                                                                                                                                2
                                                                                                                                T1012

                                                                                                                                Peripheral Device Discovery

                                                                                                                                1
                                                                                                                                T1120

                                                                                                                                System Information Discovery

                                                                                                                                2
                                                                                                                                T1082

                                                                                                                                Replay Monitor

                                                                                                                                Loading Replay Monitor...

                                                                                                                                Downloads

                                                                                                                                • memory/300-124-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/324-103-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/340-101-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/384-96-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/456-116-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/472-80-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/568-85-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/596-87-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/684-70-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/768-99-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/804-84-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/828-111-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/832-72-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/848-90-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/860-102-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/876-104-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/896-122-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/912-81-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/920-71-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1040-125-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1068-69-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1084-109-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1108-65-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1116-75-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1132-113-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1152-62-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1188-64-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1196-106-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1216-112-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1240-76-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1244-74-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1264-92-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1332-79-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1352-88-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1380-73-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1428-114-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1524-107-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1528-94-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1540-82-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1548-93-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1556-67-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1568-110-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1588-119-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1600-91-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1612-59-0x0000000000400000-0x0000000000B49000-memory.dmp
                                                                                                                                  Filesize

                                                                                                                                  7.3MB

                                                                                                                                • memory/1612-66-0x0000000000340000-0x0000000000357000-memory.dmp
                                                                                                                                  Filesize

                                                                                                                                  92KB

                                                                                                                                • memory/1612-55-0x0000000000400000-0x0000000000B49000-memory.dmp
                                                                                                                                  Filesize

                                                                                                                                  7.3MB

                                                                                                                                • memory/1612-60-0x0000000000340000-0x0000000000357000-memory.dmp
                                                                                                                                  Filesize

                                                                                                                                  92KB

                                                                                                                                • memory/1612-63-0x0000000000C83000-0x0000000000C9E000-memory.dmp
                                                                                                                                  Filesize

                                                                                                                                  108KB

                                                                                                                                • memory/1612-54-0x0000000000C83000-0x0000000000C9E000-memory.dmp
                                                                                                                                  Filesize

                                                                                                                                  108KB

                                                                                                                                • memory/1612-56-0x0000000000400000-0x0000000000B49000-memory.dmp
                                                                                                                                  Filesize

                                                                                                                                  7.3MB

                                                                                                                                • memory/1612-57-0x0000000076531000-0x0000000076533000-memory.dmp
                                                                                                                                  Filesize

                                                                                                                                  8KB

                                                                                                                                • memory/1632-117-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1648-121-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1668-86-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1688-61-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1692-68-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1708-77-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1716-115-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1724-98-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1728-97-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1736-78-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1748-100-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1756-123-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1764-118-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1840-108-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1884-89-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1936-95-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1944-83-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/1964-120-0x0000000000000000-mapping.dmp
                                                                                                                                • memory/2004-105-0x0000000000000000-mapping.dmp