gandcrab | 34d40b4abeffa21715e418205ea838928bba00ca05d47d68212bd80a9fbcd0ad

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2023, 14:26

Target

44571f9013dec5619f5838ce6785788d_mafia_JC.exe
Size

308KB
MD5

44571f9013dec5619f5838ce6785788d
SHA1

dc82667fb4f774983cc3d99a05f4dc14f529516a
SHA256

34d40b4abeffa21715e418205ea838928bba00ca05d47d68212bd80a9fbcd0ad
SHA512

db5027ed6d1bd5a2d7236cc99456ac8edd7d410b49ba6016d02cb6fa8fd463adbc21817297310076d3af211b10dbf0d30259143c4e9c11d821d73270ea808be7
SSDEEP

6144:RzL7ShWDLVzVNam6GxI29dqG3KdYAYqTuPZp:fDHNam62ZdKmZmuPH

Score

10^/10

GandCrab payload 2 IoCs

resource	yara_rule
behavioral2/memory/3508-135-0x0000000000400000-0x0000000001400000-memory.dmp	family_gandcrab
behavioral2/memory/3508-137-0x000000000C630000-0x000000000C647000-memory.dmp	family_gandcrab

Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4580	3508	WerFault.exe	81

C:\Users\Admin\AppData\Local\Temp\44571f9013dec5619f5838ce6785788d_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\44571f9013dec5619f5838ce6785788d_mafia_JC.exe"
1⤵
PID:3508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3508 -s 488
  2⤵
  - Program crash
  PID:4580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3508 -ip 3508
1⤵
PID:60

memory/3508-134-0x000000000AC90000-0x000000000AD90000-memory.dmp

Filesize
1024KB

Download
memory/3508-135-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/3508-137-0x000000000C630000-0x000000000C647000-memory.dmp

Filesize
92KB

Download