gandcrab | 4ad19caa89b586ebd8bf717a15dfa26d281d4723d2896bdc2850a96aea5cc2a0

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2023, 19:10

Target

2394918e8e5820d484adebfb2ad40bff_mafia_JC.exe
Size

312KB
MD5

2394918e8e5820d484adebfb2ad40bff
SHA1

ed26680b95f57cfe02d915b8cc7553682d51bbbe
SHA256

4ad19caa89b586ebd8bf717a15dfa26d281d4723d2896bdc2850a96aea5cc2a0
SHA512

fc12423acdbfbba0d71909330ab76f6e633156c60790ee4295bc100f6ac1bc6e436ba340d407614fdb8b0103bf35b9ab8fea43c4606a3422233b7ae3f50f2139
SSDEEP

6144:q6jtiQHr3ByVhPYDe/mZFORawnkdoo7H7MPiJT9QhrvT8vRiXdx97/uMiqa:qGTghcYaYIL7MPiJT9mP8vRiXdx97Xa

Score

10^/10

GandCrab payload 2 IoCs

resource	yara_rule
behavioral2/memory/968-136-0x0000000000400000-0x000000000044C000-memory.dmp	family_gandcrab
behavioral2/memory/968-138-0x00000000021C0000-0x00000000021D7000-memory.dmp	family_gandcrab

Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab

Program crash 1 IoCs

pid	pid_target	Process	procid_target
324	968	WerFault.exe	80

C:\Users\Admin\AppData\Local\Temp\2394918e8e5820d484adebfb2ad40bff_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2394918e8e5820d484adebfb2ad40bff_mafia_JC.exe"
1⤵
PID:968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 968 -s 476
  2⤵
  - Program crash
  PID:324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 968 -ip 968
1⤵
PID:4032

memory/968-134-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/968-135-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/968-136-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/968-138-0x00000000021C0000-0x00000000021D7000-memory.dmp

Filesize
92KB

Download