gandcrab | 2be18bf2e315f99a2991e50906304fad93d034f3e9a1fb2625c1be2a86d68c81

Analysis

max time kernel
137s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2023, 18:14

Target

7e8a3ad8e8b736b0128da13342651717_magniber_JC.exe
Size

308KB
MD5

7e8a3ad8e8b736b0128da13342651717
SHA1

5c011420e9b081068a74cd98a957daf270ff4914
SHA256

2be18bf2e315f99a2991e50906304fad93d034f3e9a1fb2625c1be2a86d68c81
SHA512

cc2b5f36f53c6c2bf65b57b13fa4201a5298172f1bbc767dc67977df54c14238c78eff139ee8dd8b65b38df20fc2a46cdf62a781bd5e1ca777fb6d8aff9fe556
SSDEEP

6144:dbUy2/9pbg0jaGGCAgOqUFzMOrKnZgsClEv:Byla0jabZFYV2s7v

Score

10^/10

GandCrab payload 2 IoCs

resource	yara_rule
behavioral2/memory/1672-3-0x0000000000400000-0x0000000000E86000-memory.dmp	family_gandcrab
behavioral2/memory/1672-4-0x0000000002C00000-0x0000000002C16000-memory.dmp	family_gandcrab

Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2976	1672	WerFault.exe	81

C:\Users\Admin\AppData\Local\Temp\7e8a3ad8e8b736b0128da13342651717_magniber_JC.exe
"C:\Users\Admin\AppData\Local\Temp\7e8a3ad8e8b736b0128da13342651717_magniber_JC.exe"
1⤵
PID:1672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 448
  2⤵
  - Program crash
  PID:2976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1672 -ip 1672
1⤵
PID:3676

memory/1672-1-0x0000000000F10000-0x0000000001010000-memory.dmp

Filesize
1024KB

Download
memory/1672-3-0x0000000000400000-0x0000000000E86000-memory.dmp

Filesize
10.5MB

Download
memory/1672-4-0x0000000002C00000-0x0000000002C16000-memory.dmp

Filesize
88KB

Download