gandcrab | 6b9122e3d2232efefdb769642c4cbae366351b6fe90aeeef2a72f42ba3537a74

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18-08-2023 14:58

Target

2e8c7e0d659e34d29b2e88a692a8dc7f_mafia_JC.exe
Size

304KB
MD5

2e8c7e0d659e34d29b2e88a692a8dc7f
SHA1

90b6cb51f692483a732b7a89fe06c97ed2553bdd
SHA256

6b9122e3d2232efefdb769642c4cbae366351b6fe90aeeef2a72f42ba3537a74
SHA512

093879604bcaaa890bda260478c9f26c08c1565bfb430c3f83ebf6d11db6b4353280f3ef6854e526ea296e449b0784ef2ce49bbc08cf1678a13baf24e31da974
SSDEEP

6144:xzL7ShWDhbzVNam6GxI29dqG3KdYAYqTuPZd:/DrNam62ZdKmZmuPz

Score

10^/10

GandCrab payload 2 IoCs

resource	yara_rule
behavioral2/memory/4240-135-0x0000000000400000-0x0000000001400000-memory.dmp	family_gandcrab
behavioral2/memory/4240-137-0x000000000C5C0000-0x000000000C5D7000-memory.dmp	family_gandcrab

Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3560	4240	WerFault.exe	80

C:\Users\Admin\AppData\Local\Temp\2e8c7e0d659e34d29b2e88a692a8dc7f_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2e8c7e0d659e34d29b2e88a692a8dc7f_mafia_JC.exe"
1⤵
PID:4240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4240 -s 480
  2⤵
  - Program crash
  PID:3560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4240 -ip 4240
1⤵
PID:1240

memory/4240-134-0x000000000AB20000-0x000000000AC20000-memory.dmp

Filesize
1024KB

Download
memory/4240-135-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/4240-137-0x000000000C5C0000-0x000000000C5D7000-memory.dmp

Filesize
92KB

Download