Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system -
submitted
08-07-2023 10:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6e9150cefd37ebexeexeexeex.exe
Resource
win7-20230703-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
6e9150cefd37ebexeexeexeex.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
6e9150cefd37ebexeexeexeex.exe
-
Size
308KB
-
MD5
6e9150cefd37ebf60875601b671f26d3
-
SHA1
d07c63d3f5116245bea986ec6d85e2b9393a89ad
-
SHA256
ae4c70ac18fd8912b0ff79931a7ee48284fa1b8cbc48386fb87a7f01fc33b192
-
SHA512
0cfb6acb100f5c54f1bd7cb4999eb048f2de371d06a533e2ab10b50f224cd261e36db063d35b1bcbfe4a02dfa006d8b3782d965775a12ed0353f98afbd9b24d6
-
SSDEEP
6144:XzL7ShWDLVzVNam6GxI29dqG3KdYAYqTuPZp:tDHNam62ZdKmZmuPH
Score
10/10
Malware Config
Signatures
-
GandCrab payload 4 IoCs
resource yara_rule behavioral1/memory/3016-55-0x0000000000400000-0x0000000001400000-memory.dmp family_gandcrab behavioral1/memory/3016-56-0x0000000000230000-0x0000000000247000-memory.dmp family_gandcrab behavioral1/memory/3016-63-0x0000000000400000-0x0000000001400000-memory.dmp family_gandcrab behavioral1/memory/3016-65-0x0000000000230000-0x0000000000247000-memory.dmp family_gandcrab -
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Unexpected DNS network traffic destination 47 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce 6e9150cefd37ebexeexeexeex.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\yolbghgknec = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\mejptb.exe\"" 6e9150cefd37ebexeexeexeex.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: 6e9150cefd37ebexeexeexeex.exe File opened (read-only) \??\P: 6e9150cefd37ebexeexeexeex.exe File opened (read-only) \??\S: 6e9150cefd37ebexeexeexeex.exe File opened (read-only) \??\X: 6e9150cefd37ebexeexeexeex.exe File opened (read-only) \??\Z: 6e9150cefd37ebexeexeexeex.exe File opened (read-only) \??\L: 6e9150cefd37ebexeexeexeex.exe File opened (read-only) \??\M: 6e9150cefd37ebexeexeexeex.exe File opened (read-only) \??\N: 6e9150cefd37ebexeexeexeex.exe File opened (read-only) \??\J: 6e9150cefd37ebexeexeexeex.exe File opened (read-only) \??\T: 6e9150cefd37ebexeexeexeex.exe File opened (read-only) \??\W: 6e9150cefd37ebexeexeexeex.exe File opened (read-only) \??\B: 6e9150cefd37ebexeexeexeex.exe File opened (read-only) \??\F: 6e9150cefd37ebexeexeexeex.exe File opened (read-only) \??\I: 6e9150cefd37ebexeexeexeex.exe File opened (read-only) \??\Q: 6e9150cefd37ebexeexeexeex.exe File opened (read-only) \??\R: 6e9150cefd37ebexeexeexeex.exe File opened (read-only) \??\V: 6e9150cefd37ebexeexeexeex.exe File opened (read-only) \??\E: 6e9150cefd37ebexeexeexeex.exe File opened (read-only) \??\G: 6e9150cefd37ebexeexeexeex.exe File opened (read-only) \??\K: 6e9150cefd37ebexeexeexeex.exe File opened (read-only) \??\Y: 6e9150cefd37ebexeexeexeex.exe File opened (read-only) \??\A: 6e9150cefd37ebexeexeexeex.exe File opened (read-only) \??\H: 6e9150cefd37ebexeexeexeex.exe File opened (read-only) \??\U: 6e9150cefd37ebexeexeexeex.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 6e9150cefd37ebexeexeexeex.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 6e9150cefd37ebexeexeexeex.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 6e9150cefd37ebexeexeexeex.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3016 6e9150cefd37ebexeexeexeex.exe 3016 6e9150cefd37ebexeexeexeex.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 3016 wrote to memory of 2952 3016 6e9150cefd37ebexeexeexeex.exe 28 PID 3016 wrote to memory of 2952 3016 6e9150cefd37ebexeexeexeex.exe 28 PID 3016 wrote to memory of 2952 3016 6e9150cefd37ebexeexeexeex.exe 28 PID 3016 wrote to memory of 2952 3016 6e9150cefd37ebexeexeexeex.exe 28 PID 3016 wrote to memory of 2400 3016 6e9150cefd37ebexeexeexeex.exe 30 PID 3016 wrote to memory of 2400 3016 6e9150cefd37ebexeexeexeex.exe 30 PID 3016 wrote to memory of 2400 3016 6e9150cefd37ebexeexeexeex.exe 30 PID 3016 wrote to memory of 2400 3016 6e9150cefd37ebexeexeexeex.exe 30 PID 3016 wrote to memory of 1724 3016 6e9150cefd37ebexeexeexeex.exe 32 PID 3016 wrote to memory of 1724 3016 6e9150cefd37ebexeexeexeex.exe 32 PID 3016 wrote to memory of 1724 3016 6e9150cefd37ebexeexeexeex.exe 32 PID 3016 wrote to memory of 1724 3016 6e9150cefd37ebexeexeexeex.exe 32 PID 3016 wrote to memory of 320 3016 6e9150cefd37ebexeexeexeex.exe 34 PID 3016 wrote to memory of 320 3016 6e9150cefd37ebexeexeexeex.exe 34 PID 3016 wrote to memory of 320 3016 6e9150cefd37ebexeexeexeex.exe 34 PID 3016 wrote to memory of 320 3016 6e9150cefd37ebexeexeexeex.exe 34 PID 3016 wrote to memory of 2844 3016 6e9150cefd37ebexeexeexeex.exe 36 PID 3016 wrote to memory of 2844 3016 6e9150cefd37ebexeexeexeex.exe 36 PID 3016 wrote to memory of 2844 3016 6e9150cefd37ebexeexeexeex.exe 36 PID 3016 wrote to memory of 2844 3016 6e9150cefd37ebexeexeexeex.exe 36 PID 3016 wrote to memory of 2912 3016 6e9150cefd37ebexeexeexeex.exe 38 PID 3016 wrote to memory of 2912 3016 6e9150cefd37ebexeexeexeex.exe 38 PID 3016 wrote to memory of 2912 3016 6e9150cefd37ebexeexeexeex.exe 38 PID 3016 wrote to memory of 2912 3016 6e9150cefd37ebexeexeexeex.exe 38 PID 3016 wrote to memory of 2544 3016 6e9150cefd37ebexeexeexeex.exe 40 PID 3016 wrote to memory of 2544 3016 6e9150cefd37ebexeexeexeex.exe 40 PID 3016 wrote to memory of 2544 3016 6e9150cefd37ebexeexeexeex.exe 40 PID 3016 wrote to memory of 2544 3016 6e9150cefd37ebexeexeexeex.exe 40 PID 3016 wrote to memory of 2556 3016 6e9150cefd37ebexeexeexeex.exe 42 PID 3016 wrote to memory of 2556 3016 6e9150cefd37ebexeexeexeex.exe 42 PID 3016 wrote to memory of 2556 3016 6e9150cefd37ebexeexeexeex.exe 42 PID 3016 wrote to memory of 2556 3016 6e9150cefd37ebexeexeexeex.exe 42 PID 3016 wrote to memory of 2612 3016 6e9150cefd37ebexeexeexeex.exe 44 PID 3016 wrote to memory of 2612 3016 6e9150cefd37ebexeexeexeex.exe 44 PID 3016 wrote to memory of 2612 3016 6e9150cefd37ebexeexeexeex.exe 44 PID 3016 wrote to memory of 2612 3016 6e9150cefd37ebexeexeexeex.exe 44 PID 3016 wrote to memory of 2616 3016 6e9150cefd37ebexeexeexeex.exe 46 PID 3016 wrote to memory of 2616 3016 6e9150cefd37ebexeexeexeex.exe 46 PID 3016 wrote to memory of 2616 3016 6e9150cefd37ebexeexeexeex.exe 46 PID 3016 wrote to memory of 2616 3016 6e9150cefd37ebexeexeexeex.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e9150cefd37ebexeexeexeex.exe"C:\Users\Admin\AppData\Local\Temp\6e9150cefd37ebexeexeexeex.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2952
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2400
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1724
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:320
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2844
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2912
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2544
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2556
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2612
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2616
-