Analysis
-
max time kernel
158s -
max time network
173s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
18/08/2023, 14:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe
Resource
win7-20230712-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe
-
Size
247KB
-
MD5
2b454fb0cf73cd809515de67817b80a5
-
SHA1
fc3889ee22994b3fb8bd0403959e37d765c7e4d3
-
SHA256
f132915dcc7712dc0ad597f4e5267e088fb62723c3d9a8459b3b8a0278c6ef72
-
SHA512
71cdc16f75704ffa58a2c8dbd2636f2cb49d85ca2e918492fcc1aca7a9912dff7ea7a5e177072a6c7b4a34335f54245c46752fbe8d8dd9ed870e0571247467cb
-
SSDEEP
3072:Ce/3l1glxNGX0+tl0BNsPmmWpOTgfgDOOK+74ArCjZ/NHkciAHaLiq7:CevEDGk+tOWmTYD/gEY/EcHKiw
Score
10/10
Malware Config
Signatures
-
GandCrab payload 4 IoCs
resource yara_rule behavioral1/memory/2596-57-0x0000000000400000-0x0000000000443000-memory.dmp family_gandcrab behavioral1/memory/2596-59-0x0000000000280000-0x0000000000297000-memory.dmp family_gandcrab behavioral1/memory/2596-67-0x0000000000400000-0x0000000000443000-memory.dmp family_gandcrab behavioral1/memory/2596-69-0x0000000000280000-0x0000000000297000-memory.dmp family_gandcrab -
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Unexpected DNS network traffic destination 60 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dewhizaczou = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\galbyf.exe\"" 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe File opened (read-only) \??\U: 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe File opened (read-only) \??\V: 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe File opened (read-only) \??\H: 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe File opened (read-only) \??\I: 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe File opened (read-only) \??\Q: 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe File opened (read-only) \??\S: 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe File opened (read-only) \??\T: 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe File opened (read-only) \??\W: 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe File opened (read-only) \??\A: 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe File opened (read-only) \??\B: 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe File opened (read-only) \??\E: 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe File opened (read-only) \??\G: 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe File opened (read-only) \??\O: 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe File opened (read-only) \??\P: 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe File opened (read-only) \??\R: 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe File opened (read-only) \??\J: 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe File opened (read-only) \??\K: 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe File opened (read-only) \??\L: 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe File opened (read-only) \??\N: 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe File opened (read-only) \??\X: 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe File opened (read-only) \??\Y: 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe File opened (read-only) \??\Z: 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 2596 wrote to memory of 2280 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 28 PID 2596 wrote to memory of 2280 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 28 PID 2596 wrote to memory of 2280 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 28 PID 2596 wrote to memory of 2280 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 28 PID 2596 wrote to memory of 2712 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 32 PID 2596 wrote to memory of 2712 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 32 PID 2596 wrote to memory of 2712 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 32 PID 2596 wrote to memory of 2712 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 32 PID 2596 wrote to memory of 1752 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 34 PID 2596 wrote to memory of 1752 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 34 PID 2596 wrote to memory of 1752 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 34 PID 2596 wrote to memory of 1752 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 34 PID 2596 wrote to memory of 1104 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 36 PID 2596 wrote to memory of 1104 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 36 PID 2596 wrote to memory of 1104 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 36 PID 2596 wrote to memory of 1104 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 36 PID 2596 wrote to memory of 696 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 38 PID 2596 wrote to memory of 696 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 38 PID 2596 wrote to memory of 696 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 38 PID 2596 wrote to memory of 696 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 38 PID 2596 wrote to memory of 576 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 40 PID 2596 wrote to memory of 576 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 40 PID 2596 wrote to memory of 576 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 40 PID 2596 wrote to memory of 576 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 40 PID 2596 wrote to memory of 564 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 42 PID 2596 wrote to memory of 564 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 42 PID 2596 wrote to memory of 564 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 42 PID 2596 wrote to memory of 564 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 42 PID 2596 wrote to memory of 1560 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 44 PID 2596 wrote to memory of 1560 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 44 PID 2596 wrote to memory of 1560 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 44 PID 2596 wrote to memory of 1560 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 44 PID 2596 wrote to memory of 2144 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 46 PID 2596 wrote to memory of 2144 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 46 PID 2596 wrote to memory of 2144 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 46 PID 2596 wrote to memory of 2144 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 46 PID 2596 wrote to memory of 2368 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 48 PID 2596 wrote to memory of 2368 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 48 PID 2596 wrote to memory of 2368 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 48 PID 2596 wrote to memory of 2368 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 48 PID 2596 wrote to memory of 2924 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 50 PID 2596 wrote to memory of 2924 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 50 PID 2596 wrote to memory of 2924 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 50 PID 2596 wrote to memory of 2924 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 50 PID 2596 wrote to memory of 1100 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 52 PID 2596 wrote to memory of 1100 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 52 PID 2596 wrote to memory of 1100 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 52 PID 2596 wrote to memory of 1100 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 52 PID 2596 wrote to memory of 1124 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 54 PID 2596 wrote to memory of 1124 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 54 PID 2596 wrote to memory of 1124 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 54 PID 2596 wrote to memory of 1124 2596 2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe 54
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2b454fb0cf73cd809515de67817b80a5_mafia_JC.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2280
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2712
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1752
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1104
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:696
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:576
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:564
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1560
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2144
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2368
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2924
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1100
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1124
-