gandcrab | 45250e922ccef78536c50bcb78604ef92d22f7414f667ab5543caa96312c2b64 | Triage

Analysis

max time kernel
87s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18-07-2023 15:34

Sharing

Report Analysis Logs

General

Target

c108cf148871b8_JC.exe
Size

308KB
MD5

c108cf148871b86e6409f6236d375954
SHA1

6ca6a634311ae3495bdf4dad97bf9620c54537ec
SHA256

45250e922ccef78536c50bcb78604ef92d22f7414f667ab5543caa96312c2b64
SHA512

6dd04388be147ca990cb77541c12edc1aa4c94442cdc5331f76ee124915a91af482ac93b5982c316685fe364200775d9aee2041b31e2b57c8236380368ea7101
SSDEEP

6144:HzL7ShWDLVzVNam6GxI29dqG3KdYAYqTuPZp:dDHNam62ZdKmZmuPH

Score

10^/10

gandcrab backdoor ransomware

Malware Config

Signatures

GandCrab payload 2 IoCs

resource	yara_rule
behavioral2/memory/1752-135-0x0000000000400000-0x0000000001400000-memory.dmp	family_gandcrab
behavioral2/memory/1752-137-0x000000000AA70000-0x000000000AA87000-memory.dmp	family_gandcrab

Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2940	1752	WerFault.exe	83

C:\Users\Admin\AppData\Local\Temp\c108cf148871b8_JC.exe
"C:\Users\Admin\AppData\Local\Temp\c108cf148871b8_JC.exe"
1⤵
PID:1752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 472
  2⤵
  - Program crash
  PID:2940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1752 -ip 1752
1⤵
PID:3164

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1752-134-0x000000000AAA0000-0x000000000ABA0000-memory.dmp

Filesize
1024KB

Download
memory/1752-135-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1752-137-0x000000000AA70000-0x000000000AA87000-memory.dmp

Filesize
92KB

Download