Analysis
-
max time kernel
142s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
05-07-2023 20:04
Behavioral task
behavioral1
Sample
1ea41c5ee94b23exeexeexeex.exe
Resource
win7-20230703-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
1ea41c5ee94b23exeexeexeex.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
1ea41c5ee94b23exeexeexeex.exe
-
Size
145KB
-
MD5
1ea41c5ee94b23b2932479cabca58011
-
SHA1
d372e5d32171a27ec4e5d805b365e0b329d875f9
-
SHA256
2d07336332b50a4a9d94e2d35a99a46b0d32a1ae6029b6225b40da6843986e6e
-
SHA512
ee4006be76a8f3513f83e4ea7120d484ddb18b5305af79d60368088159ecc15d13d7f2d61584df3a9ca1d8efdd8a554881ae8bf3fdcb093b9befe27f0f605837
-
SSDEEP
3072:oYHVHd2NCMqqDL2/mr3IdE8we0Avu5r++ygLIaagvdCjRv9OtN:oyOqqDL64vdGREz
Score
10/10
Malware Config
Signatures
-
GandCrab payload 2 IoCs
resource yara_rule behavioral2/memory/2896-133-0x0000000000400000-0x0000000000428000-memory.dmp family_gandcrab behavioral2/memory/2896-137-0x0000000000400000-0x0000000000428000-memory.dmp family_gandcrab -
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce 1ea41c5ee94b23exeexeexeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\iydbaqjusbp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1ea41c5ee94b23exeexeexeex.exe" 1ea41c5ee94b23exeexeexeex.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: 1ea41c5ee94b23exeexeexeex.exe File opened (read-only) \??\A: 1ea41c5ee94b23exeexeexeex.exe File opened (read-only) \??\H: 1ea41c5ee94b23exeexeexeex.exe File opened (read-only) \??\L: 1ea41c5ee94b23exeexeexeex.exe File opened (read-only) \??\N: 1ea41c5ee94b23exeexeexeex.exe File opened (read-only) \??\O: 1ea41c5ee94b23exeexeexeex.exe File opened (read-only) \??\U: 1ea41c5ee94b23exeexeexeex.exe File opened (read-only) \??\V: 1ea41c5ee94b23exeexeexeex.exe File opened (read-only) \??\Y: 1ea41c5ee94b23exeexeexeex.exe File opened (read-only) \??\Z: 1ea41c5ee94b23exeexeexeex.exe File opened (read-only) \??\E: 1ea41c5ee94b23exeexeexeex.exe File opened (read-only) \??\J: 1ea41c5ee94b23exeexeexeex.exe File opened (read-only) \??\M: 1ea41c5ee94b23exeexeexeex.exe File opened (read-only) \??\R: 1ea41c5ee94b23exeexeexeex.exe File opened (read-only) \??\B: 1ea41c5ee94b23exeexeexeex.exe File opened (read-only) \??\G: 1ea41c5ee94b23exeexeexeex.exe File opened (read-only) \??\K: 1ea41c5ee94b23exeexeexeex.exe File opened (read-only) \??\P: 1ea41c5ee94b23exeexeexeex.exe File opened (read-only) \??\Q: 1ea41c5ee94b23exeexeexeex.exe File opened (read-only) \??\S: 1ea41c5ee94b23exeexeexeex.exe File opened (read-only) \??\I: 1ea41c5ee94b23exeexeexeex.exe File opened (read-only) \??\T: 1ea41c5ee94b23exeexeexeex.exe File opened (read-only) \??\W: 1ea41c5ee94b23exeexeexeex.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 1ea41c5ee94b23exeexeexeex.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 1ea41c5ee94b23exeexeexeex.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 1ea41c5ee94b23exeexeexeex.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2896 1ea41c5ee94b23exeexeexeex.exe 2896 1ea41c5ee94b23exeexeexeex.exe 2896 1ea41c5ee94b23exeexeexeex.exe 2896 1ea41c5ee94b23exeexeexeex.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 2896 wrote to memory of 1316 2896 1ea41c5ee94b23exeexeexeex.exe 88 PID 2896 wrote to memory of 1316 2896 1ea41c5ee94b23exeexeexeex.exe 88 PID 2896 wrote to memory of 1316 2896 1ea41c5ee94b23exeexeexeex.exe 88 PID 2896 wrote to memory of 4004 2896 1ea41c5ee94b23exeexeexeex.exe 91 PID 2896 wrote to memory of 4004 2896 1ea41c5ee94b23exeexeexeex.exe 91 PID 2896 wrote to memory of 4004 2896 1ea41c5ee94b23exeexeexeex.exe 91 PID 2896 wrote to memory of 3888 2896 1ea41c5ee94b23exeexeexeex.exe 93 PID 2896 wrote to memory of 3888 2896 1ea41c5ee94b23exeexeexeex.exe 93 PID 2896 wrote to memory of 3888 2896 1ea41c5ee94b23exeexeexeex.exe 93 PID 2896 wrote to memory of 3824 2896 1ea41c5ee94b23exeexeexeex.exe 98 PID 2896 wrote to memory of 3824 2896 1ea41c5ee94b23exeexeexeex.exe 98 PID 2896 wrote to memory of 3824 2896 1ea41c5ee94b23exeexeexeex.exe 98 PID 2896 wrote to memory of 2452 2896 1ea41c5ee94b23exeexeexeex.exe 100 PID 2896 wrote to memory of 2452 2896 1ea41c5ee94b23exeexeexeex.exe 100 PID 2896 wrote to memory of 2452 2896 1ea41c5ee94b23exeexeexeex.exe 100 PID 2896 wrote to memory of 4228 2896 1ea41c5ee94b23exeexeexeex.exe 102 PID 2896 wrote to memory of 4228 2896 1ea41c5ee94b23exeexeexeex.exe 102 PID 2896 wrote to memory of 4228 2896 1ea41c5ee94b23exeexeexeex.exe 102 PID 2896 wrote to memory of 4668 2896 1ea41c5ee94b23exeexeexeex.exe 104 PID 2896 wrote to memory of 4668 2896 1ea41c5ee94b23exeexeexeex.exe 104 PID 2896 wrote to memory of 4668 2896 1ea41c5ee94b23exeexeexeex.exe 104 PID 2896 wrote to memory of 4328 2896 1ea41c5ee94b23exeexeexeex.exe 106 PID 2896 wrote to memory of 4328 2896 1ea41c5ee94b23exeexeexeex.exe 106 PID 2896 wrote to memory of 4328 2896 1ea41c5ee94b23exeexeexeex.exe 106 PID 2896 wrote to memory of 484 2896 1ea41c5ee94b23exeexeexeex.exe 108 PID 2896 wrote to memory of 484 2896 1ea41c5ee94b23exeexeexeex.exe 108 PID 2896 wrote to memory of 484 2896 1ea41c5ee94b23exeexeexeex.exe 108 PID 2896 wrote to memory of 1280 2896 1ea41c5ee94b23exeexeexeex.exe 110 PID 2896 wrote to memory of 1280 2896 1ea41c5ee94b23exeexeexeex.exe 110 PID 2896 wrote to memory of 1280 2896 1ea41c5ee94b23exeexeexeex.exe 110 PID 2896 wrote to memory of 496 2896 1ea41c5ee94b23exeexeexeex.exe 112 PID 2896 wrote to memory of 496 2896 1ea41c5ee94b23exeexeexeex.exe 112 PID 2896 wrote to memory of 496 2896 1ea41c5ee94b23exeexeexeex.exe 112 PID 2896 wrote to memory of 4860 2896 1ea41c5ee94b23exeexeexeex.exe 114 PID 2896 wrote to memory of 4860 2896 1ea41c5ee94b23exeexeexeex.exe 114 PID 2896 wrote to memory of 4860 2896 1ea41c5ee94b23exeexeexeex.exe 114 PID 2896 wrote to memory of 4972 2896 1ea41c5ee94b23exeexeexeex.exe 116 PID 2896 wrote to memory of 4972 2896 1ea41c5ee94b23exeexeexeex.exe 116 PID 2896 wrote to memory of 4972 2896 1ea41c5ee94b23exeexeexeex.exe 116 PID 2896 wrote to memory of 4432 2896 1ea41c5ee94b23exeexeexeex.exe 118 PID 2896 wrote to memory of 4432 2896 1ea41c5ee94b23exeexeexeex.exe 118 PID 2896 wrote to memory of 4432 2896 1ea41c5ee94b23exeexeexeex.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ea41c5ee94b23exeexeexeex.exe"C:\Users\Admin\AppData\Local\Temp\1ea41c5ee94b23exeexeexeex.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:1316
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵PID:4004
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:3888
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:3824
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵PID:2452
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:4228
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:4668
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵PID:4328
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:484
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:1280
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵PID:496
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:4860
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:4972
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵PID:4432
-