Analysis

  • max time kernel
    151s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20220718-en
  • resource tags

    arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
  • submitted
    25-07-2022 02:52

General

  • Target

    5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe

  • Size

    69KB

  • MD5

    c87568abcff8af054b35812c1752144b

  • SHA1

    4361d2d3a072491d3544ff0f3bff3af9a6989546

  • SHA256

    5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588

  • SHA512

    3ffae5426a7ef63fb7c0eb7c91f003b37f0f1b98e71030350a6cf06dcf482897d2736b8253e5ec0d585e63f3b3a4c19b0badc45fe77c94db27e9f963a39e3489

Score
10/10

Malware Config

Signatures

  • suricata: ET MALWARE Observed GandCrab Domain (gandcrab .bit)

    suricata: ET MALWARE Observed GandCrab Domain (gandcrab .bit)

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe
    "C:\Users\Admin\AppData\Local\Temp\5684f9e666d7e107fbec783cdc675a2addb65ae593fddffae6c8a38942b60588.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:948
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup nomoreransom.coin dns1.soprodns.ru
      2⤵
        PID:2004
      • C:\Windows\SysWOW64\nslookup.exe
        nslookup nomoreransom.bit dns1.soprodns.ru
        2⤵
          PID:1144
        • C:\Windows\SysWOW64\nslookup.exe
          nslookup gandcrab.bit dns2.soprodns.ru
          2⤵
            PID:864
          • C:\Windows\SysWOW64\nslookup.exe
            nslookup nomoreransom.coin dns2.soprodns.ru
            2⤵
              PID:1460
            • C:\Windows\SysWOW64\nslookup.exe
              nslookup nomoreransom.bit dns2.soprodns.ru
              2⤵
                PID:1528
              • C:\Windows\SysWOW64\nslookup.exe
                nslookup gandcrab.bit dns1.soprodns.ru
                2⤵
                  PID:1920
                • C:\Windows\SysWOW64\nslookup.exe
                  nslookup nomoreransom.coin dns1.soprodns.ru
                  2⤵
                    PID:1588
                  • C:\Windows\SysWOW64\nslookup.exe
                    nslookup nomoreransom.bit dns1.soprodns.ru
                    2⤵
                      PID:1464
                    • C:\Windows\SysWOW64\nslookup.exe
                      nslookup gandcrab.bit dns2.soprodns.ru
                      2⤵
                        PID:1284
                      • C:\Windows\SysWOW64\nslookup.exe
                        nslookup nomoreransom.coin dns2.soprodns.ru
                        2⤵
                          PID:2024
                        • C:\Windows\SysWOW64\nslookup.exe
                          nslookup nomoreransom.bit dns2.soprodns.ru
                          2⤵
                            PID:692
                          • C:\Windows\SysWOW64\nslookup.exe
                            nslookup gandcrab.bit dns1.soprodns.ru
                            2⤵
                              PID:824
                            • C:\Windows\SysWOW64\nslookup.exe
                              nslookup nomoreransom.coin dns1.soprodns.ru
                              2⤵
                                PID:1124
                              • C:\Windows\SysWOW64\nslookup.exe
                                nslookup nomoreransom.bit dns1.soprodns.ru
                                2⤵
                                  PID:1476
                                • C:\Windows\SysWOW64\nslookup.exe
                                  nslookup gandcrab.bit dns2.soprodns.ru
                                  2⤵
                                    PID:1788
                                  • C:\Windows\SysWOW64\nslookup.exe
                                    nslookup nomoreransom.coin dns2.soprodns.ru
                                    2⤵
                                      PID:852
                                    • C:\Windows\SysWOW64\nslookup.exe
                                      nslookup nomoreransom.bit dns2.soprodns.ru
                                      2⤵
                                        PID:1456
                                      • C:\Windows\SysWOW64\nslookup.exe
                                        nslookup gandcrab.bit dns1.soprodns.ru
                                        2⤵
                                          PID:1860
                                        • C:\Windows\SysWOW64\nslookup.exe
                                          nslookup nomoreransom.coin dns1.soprodns.ru
                                          2⤵
                                            PID:1008
                                          • C:\Windows\SysWOW64\nslookup.exe
                                            nslookup nomoreransom.bit dns1.soprodns.ru
                                            2⤵
                                              PID:1784
                                            • C:\Windows\SysWOW64\nslookup.exe
                                              nslookup gandcrab.bit dns2.soprodns.ru
                                              2⤵
                                                PID:748
                                              • C:\Windows\SysWOW64\nslookup.exe
                                                nslookup nomoreransom.coin dns2.soprodns.ru
                                                2⤵
                                                  PID:1488
                                                • C:\Windows\SysWOW64\nslookup.exe
                                                  nslookup nomoreransom.bit dns2.soprodns.ru
                                                  2⤵
                                                    PID:1964
                                                  • C:\Windows\SysWOW64\nslookup.exe
                                                    nslookup gandcrab.bit dns1.soprodns.ru
                                                    2⤵
                                                      PID:456
                                                    • C:\Windows\SysWOW64\nslookup.exe
                                                      nslookup nomoreransom.coin dns1.soprodns.ru
                                                      2⤵
                                                        PID:1720
                                                      • C:\Windows\SysWOW64\nslookup.exe
                                                        nslookup nomoreransom.bit dns1.soprodns.ru
                                                        2⤵
                                                          PID:1572
                                                        • C:\Windows\SysWOW64\nslookup.exe
                                                          nslookup gandcrab.bit dns2.soprodns.ru
                                                          2⤵
                                                            PID:1752
                                                          • C:\Windows\SysWOW64\nslookup.exe
                                                            nslookup nomoreransom.coin dns2.soprodns.ru
                                                            2⤵
                                                              PID:1688
                                                            • C:\Windows\SysWOW64\nslookup.exe
                                                              nslookup nomoreransom.bit dns2.soprodns.ru
                                                              2⤵
                                                                PID:2012
                                                              • C:\Windows\SysWOW64\nslookup.exe
                                                                nslookup gandcrab.bit dns1.soprodns.ru
                                                                2⤵
                                                                  PID:1352
                                                                • C:\Windows\SysWOW64\nslookup.exe
                                                                  nslookup nomoreransom.coin dns1.soprodns.ru
                                                                  2⤵
                                                                    PID:1896
                                                                  • C:\Windows\SysWOW64\nslookup.exe
                                                                    nslookup nomoreransom.bit dns1.soprodns.ru
                                                                    2⤵
                                                                      PID:1432
                                                                    • C:\Windows\SysWOW64\nslookup.exe
                                                                      nslookup gandcrab.bit dns2.soprodns.ru
                                                                      2⤵
                                                                        PID:1660
                                                                      • C:\Windows\SysWOW64\nslookup.exe
                                                                        nslookup nomoreransom.coin dns2.soprodns.ru
                                                                        2⤵
                                                                          PID:1120
                                                                        • C:\Windows\SysWOW64\nslookup.exe
                                                                          nslookup nomoreransom.bit dns2.soprodns.ru
                                                                          2⤵
                                                                            PID:1624
                                                                          • C:\Windows\SysWOW64\nslookup.exe
                                                                            nslookup gandcrab.bit dns1.soprodns.ru
                                                                            2⤵
                                                                              PID:976
                                                                            • C:\Windows\SysWOW64\nslookup.exe
                                                                              nslookup nomoreransom.coin dns1.soprodns.ru
                                                                              2⤵
                                                                                PID:1544
                                                                              • C:\Windows\SysWOW64\nslookup.exe
                                                                                nslookup nomoreransom.bit dns1.soprodns.ru
                                                                                2⤵
                                                                                  PID:1952
                                                                                • C:\Windows\SysWOW64\nslookup.exe
                                                                                  nslookup gandcrab.bit dns2.soprodns.ru
                                                                                  2⤵
                                                                                    PID:1692
                                                                                  • C:\Windows\SysWOW64\nslookup.exe
                                                                                    nslookup nomoreransom.coin dns2.soprodns.ru
                                                                                    2⤵
                                                                                      PID:1736
                                                                                    • C:\Windows\SysWOW64\nslookup.exe
                                                                                      nslookup nomoreransom.bit dns2.soprodns.ru
                                                                                      2⤵
                                                                                        PID:328
                                                                                      • C:\Windows\SysWOW64\nslookup.exe
                                                                                        nslookup gandcrab.bit dns1.soprodns.ru
                                                                                        2⤵
                                                                                          PID:284
                                                                                        • C:\Windows\SysWOW64\nslookup.exe
                                                                                          nslookup nomoreransom.coin dns1.soprodns.ru
                                                                                          2⤵
                                                                                            PID:648
                                                                                          • C:\Windows\SysWOW64\nslookup.exe
                                                                                            nslookup nomoreransom.bit dns1.soprodns.ru
                                                                                            2⤵
                                                                                              PID:1992
                                                                                            • C:\Windows\SysWOW64\nslookup.exe
                                                                                              nslookup gandcrab.bit dns2.soprodns.ru
                                                                                              2⤵
                                                                                                PID:1212
                                                                                              • C:\Windows\SysWOW64\nslookup.exe
                                                                                                nslookup nomoreransom.coin dns2.soprodns.ru
                                                                                                2⤵
                                                                                                  PID:564
                                                                                                • C:\Windows\SysWOW64\nslookup.exe
                                                                                                  nslookup nomoreransom.bit dns2.soprodns.ru
                                                                                                  2⤵
                                                                                                    PID:1932
                                                                                                  • C:\Windows\SysWOW64\nslookup.exe
                                                                                                    nslookup gandcrab.bit dns1.soprodns.ru
                                                                                                    2⤵
                                                                                                      PID:956
                                                                                                    • C:\Windows\SysWOW64\nslookup.exe
                                                                                                      nslookup nomoreransom.coin dns1.soprodns.ru
                                                                                                      2⤵
                                                                                                        PID:556
                                                                                                      • C:\Windows\SysWOW64\nslookup.exe
                                                                                                        nslookup nomoreransom.bit dns1.soprodns.ru
                                                                                                        2⤵
                                                                                                          PID:1604
                                                                                                        • C:\Windows\SysWOW64\nslookup.exe
                                                                                                          nslookup gandcrab.bit dns2.soprodns.ru
                                                                                                          2⤵
                                                                                                            PID:2008
                                                                                                          • C:\Windows\SysWOW64\nslookup.exe
                                                                                                            nslookup nomoreransom.coin dns2.soprodns.ru
                                                                                                            2⤵
                                                                                                              PID:1504
                                                                                                            • C:\Windows\SysWOW64\nslookup.exe
                                                                                                              nslookup nomoreransom.bit dns2.soprodns.ru
                                                                                                              2⤵
                                                                                                                PID:1112
                                                                                                              • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                nslookup gandcrab.bit dns1.soprodns.ru
                                                                                                                2⤵
                                                                                                                  PID:1424
                                                                                                                • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                  nslookup nomoreransom.coin dns1.soprodns.ru
                                                                                                                  2⤵
                                                                                                                    PID:1036
                                                                                                                  • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                    nslookup nomoreransom.bit dns1.soprodns.ru
                                                                                                                    2⤵
                                                                                                                      PID:1088
                                                                                                                    • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                      nslookup gandcrab.bit dns2.soprodns.ru
                                                                                                                      2⤵
                                                                                                                        PID:1924
                                                                                                                      • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                        nslookup nomoreransom.coin dns2.soprodns.ru
                                                                                                                        2⤵
                                                                                                                          PID:768
                                                                                                                        • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                          nslookup nomoreransom.bit dns2.soprodns.ru
                                                                                                                          2⤵
                                                                                                                            PID:304
                                                                                                                          • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                            nslookup gandcrab.bit dns1.soprodns.ru
                                                                                                                            2⤵
                                                                                                                              PID:368
                                                                                                                            • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                              nslookup nomoreransom.coin dns1.soprodns.ru
                                                                                                                              2⤵
                                                                                                                                PID:1680
                                                                                                                              • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                nslookup nomoreransom.bit dns1.soprodns.ru
                                                                                                                                2⤵
                                                                                                                                  PID:532
                                                                                                                                • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                  nslookup gandcrab.bit dns2.soprodns.ru
                                                                                                                                  2⤵
                                                                                                                                    PID:1772
                                                                                                                                  • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                    nslookup nomoreransom.coin dns2.soprodns.ru
                                                                                                                                    2⤵
                                                                                                                                      PID:1280
                                                                                                                                    • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                      nslookup nomoreransom.bit dns2.soprodns.ru
                                                                                                                                      2⤵
                                                                                                                                        PID:1948
                                                                                                                                      • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                        nslookup gandcrab.bit dns1.soprodns.ru
                                                                                                                                        2⤵
                                                                                                                                          PID:1440
                                                                                                                                        • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                          nslookup nomoreransom.coin dns1.soprodns.ru
                                                                                                                                          2⤵
                                                                                                                                            PID:1888
                                                                                                                                          • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                                            nslookup nomoreransom.bit dns1.soprodns.ru
                                                                                                                                            2⤵
                                                                                                                                              PID:868

                                                                                                                                          Network

                                                                                                                                          MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                                          Persistence

                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                          1
                                                                                                                                          T1060

                                                                                                                                          Defense Evasion

                                                                                                                                          Modify Registry

                                                                                                                                          1
                                                                                                                                          T1112

                                                                                                                                          Discovery

                                                                                                                                          Query Registry

                                                                                                                                          2
                                                                                                                                          T1012

                                                                                                                                          Peripheral Device Discovery

                                                                                                                                          1
                                                                                                                                          T1120

                                                                                                                                          System Information Discovery

                                                                                                                                          2
                                                                                                                                          T1082

                                                                                                                                          Replay Monitor

                                                                                                                                          Loading Replay Monitor...

                                                                                                                                          Downloads

                                                                                                                                          • memory/284-96-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/304-113-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/328-95-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/368-114-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/456-78-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/532-116-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/556-103-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/564-100-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/648-97-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/692-65-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/748-75-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/768-112-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/824-66-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/852-70-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/864-57-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/948-54-0x0000000076281000-0x0000000076283000-memory.dmp
                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                          • memory/956-102-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/976-90-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1008-73-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1036-109-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1088-110-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1112-107-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1120-88-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1124-67-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1144-56-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1212-99-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1280-118-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1284-63-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1352-84-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1424-108-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1432-86-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1456-71-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1460-58-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1464-62-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1476-68-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1488-76-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1504-106-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1528-59-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1544-91-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1572-80-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1588-61-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1604-104-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1624-89-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1660-87-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1680-115-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1688-82-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1692-93-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1720-79-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1736-94-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1752-81-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1772-117-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1784-74-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1788-69-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1860-72-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1896-85-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1920-60-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1924-111-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1932-101-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1952-92-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1964-77-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/1992-98-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/2004-55-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/2008-105-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/2012-83-0x0000000000000000-mapping.dmp
                                                                                                                                          • memory/2024-64-0x0000000000000000-mapping.dmp