Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
23/08/2023, 17:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe
Resource
win7-20230712-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe
-
Size
325KB
-
MD5
7b22ff49cb0d5b356ef3dfd0aac8992a
-
SHA1
d2d29fa28f79cab1c4b1feb322defdca9b16066d
-
SHA256
ef8ca0eb658e3a19d2cb48d8f12448925da043ecf5b8487a6e733a13e95c72de
-
SHA512
60abda930faf0a659ab7924a2ffd2aa920b34017cb6590809d649f1113d41de886a24823a48b5960f350496367cbedba0c369699c03177d22b117f56486d5819
-
SSDEEP
6144:85OGTnncBQmBCjTlOgLA3tjp7OEyXk0Lk3dgvXr:oBTwrBCjTcgLA33aEyUak3dgvb
Score
10/10
Malware Config
Signatures
-
GandCrab payload 4 IoCs
resource yara_rule behavioral1/memory/2180-1-0x0000000000400000-0x0000000003BA2000-memory.dmp family_gandcrab behavioral1/memory/2180-3-0x0000000003BB0000-0x0000000003BC7000-memory.dmp family_gandcrab behavioral1/memory/2180-11-0x0000000000400000-0x0000000003BA2000-memory.dmp family_gandcrab behavioral1/memory/2180-12-0x0000000003BB0000-0x0000000003BC7000-memory.dmp family_gandcrab -
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Unexpected DNS network traffic destination 62 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\utdwigqhjgh = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\kbjwvz.exe\"" 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe File opened (read-only) \??\G: 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe File opened (read-only) \??\L: 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe File opened (read-only) \??\T: 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe File opened (read-only) \??\U: 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe File opened (read-only) \??\V: 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe File opened (read-only) \??\Y: 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe File opened (read-only) \??\B: 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe File opened (read-only) \??\I: 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe File opened (read-only) \??\K: 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe File opened (read-only) \??\N: 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe File opened (read-only) \??\S: 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe File opened (read-only) \??\A: 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe File opened (read-only) \??\H: 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe File opened (read-only) \??\J: 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe File opened (read-only) \??\M: 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe File opened (read-only) \??\O: 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe File opened (read-only) \??\Q: 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe File opened (read-only) \??\R: 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe File opened (read-only) \??\W: 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe File opened (read-only) \??\P: 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe File opened (read-only) \??\X: 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe File opened (read-only) \??\Z: 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe -
Suspicious use of SetWindowsHookAW 64 IoCs
pid Process 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 2180 wrote to memory of 1908 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 30 PID 2180 wrote to memory of 1908 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 30 PID 2180 wrote to memory of 1908 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 30 PID 2180 wrote to memory of 1908 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 30 PID 2180 wrote to memory of 2236 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 32 PID 2180 wrote to memory of 2236 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 32 PID 2180 wrote to memory of 2236 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 32 PID 2180 wrote to memory of 2236 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 32 PID 2180 wrote to memory of 3000 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 34 PID 2180 wrote to memory of 3000 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 34 PID 2180 wrote to memory of 3000 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 34 PID 2180 wrote to memory of 3000 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 34 PID 2180 wrote to memory of 2532 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 36 PID 2180 wrote to memory of 2532 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 36 PID 2180 wrote to memory of 2532 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 36 PID 2180 wrote to memory of 2532 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 36 PID 2180 wrote to memory of 2868 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 38 PID 2180 wrote to memory of 2868 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 38 PID 2180 wrote to memory of 2868 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 38 PID 2180 wrote to memory of 2868 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 38 PID 2180 wrote to memory of 2784 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 40 PID 2180 wrote to memory of 2784 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 40 PID 2180 wrote to memory of 2784 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 40 PID 2180 wrote to memory of 2784 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 40 PID 2180 wrote to memory of 2588 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 42 PID 2180 wrote to memory of 2588 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 42 PID 2180 wrote to memory of 2588 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 42 PID 2180 wrote to memory of 2588 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 42 PID 2180 wrote to memory of 2776 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 44 PID 2180 wrote to memory of 2776 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 44 PID 2180 wrote to memory of 2776 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 44 PID 2180 wrote to memory of 2776 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 44 PID 2180 wrote to memory of 2876 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 46 PID 2180 wrote to memory of 2876 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 46 PID 2180 wrote to memory of 2876 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 46 PID 2180 wrote to memory of 2876 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 46 PID 2180 wrote to memory of 2824 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 48 PID 2180 wrote to memory of 2824 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 48 PID 2180 wrote to memory of 2824 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 48 PID 2180 wrote to memory of 2824 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 48 PID 2180 wrote to memory of 2672 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 50 PID 2180 wrote to memory of 2672 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 50 PID 2180 wrote to memory of 2672 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 50 PID 2180 wrote to memory of 2672 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 50 PID 2180 wrote to memory of 2460 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 52 PID 2180 wrote to memory of 2460 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 52 PID 2180 wrote to memory of 2460 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 52 PID 2180 wrote to memory of 2460 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 52 PID 2180 wrote to memory of 2640 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 54 PID 2180 wrote to memory of 2640 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 54 PID 2180 wrote to memory of 2640 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 54 PID 2180 wrote to memory of 2640 2180 7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe 54
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\7b22ff49cb0d5b356ef3dfd0aac8992a_mafia_JC.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookAW
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1908
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2236
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:3000
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2532
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2868
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2784
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2588
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2776
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2876
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2824
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2672
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2460
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2640
-