Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
20-08-2023 11:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
54398c18d7ed8a1bc4ed49b7cf0413a8_mafia_JC.exe
Resource
win7-20230712-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
54398c18d7ed8a1bc4ed49b7cf0413a8_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
54398c18d7ed8a1bc4ed49b7cf0413a8_mafia_JC.exe
-
Size
288KB
-
MD5
54398c18d7ed8a1bc4ed49b7cf0413a8
-
SHA1
2d2032ea9a3725a271144e121672393d5a465e94
-
SHA256
fa3a17528f1d00af1bdc48225f8bacfe32b90e251d88364d95c6da1a6e64e8bb
-
SHA512
71d6589b368d4cae4bc04219e2d7656a6534d741b855f987090ae864385ce2d2f3177c0754cc3e35a0d000358041689cc54343ba94041beb475bf054393a1056
-
SSDEEP
6144:+EmWsg+ldJlDBTElic17q/mxjciIoDKCQ9Coaa:+EmkQdJlDmMcjxJc9Coaa
Score
10/10
Malware Config
Signatures
-
GandCrab payload 2 IoCs
resource yara_rule behavioral2/memory/1280-134-0x0000000000400000-0x0000000000842000-memory.dmp family_gandcrab behavioral2/memory/1280-136-0x0000000000B00000-0x0000000000B16000-memory.dmp family_gandcrab -
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1648 1280 WerFault.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\54398c18d7ed8a1bc4ed49b7cf0413a8_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\54398c18d7ed8a1bc4ed49b7cf0413a8_mafia_JC.exe"1⤵PID:1280
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1280 -s 3402⤵
- Program crash
PID:1648
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1280 -ip 12801⤵PID:2552