gandcrab | f6b9132df3cb3df0d683460fd4cc918ad0b1d9c2a5777435d0fec43038c233a4

Analysis

max time kernel
91s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230824-en
resource tags

arch:x64arch:x86image:win10v2004-20230824-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2023, 12:45

Target

9fad3216d8d89939f2e8849cf1a8dff5_mafia_magniber_JC.exe
Size

308KB
MD5

9fad3216d8d89939f2e8849cf1a8dff5
SHA1

8bd6318aea3cf94835045351a3f9a5148174e384
SHA256

f6b9132df3cb3df0d683460fd4cc918ad0b1d9c2a5777435d0fec43038c233a4
SHA512

cf0f0af17c391b009f0ff88e5540bc9773f90aec03231632924cadb14354e0291f63e9111b4f861a8f65832572a0fc6867cc08fe6b11e5f522ba9980f594d0cd
SSDEEP

3072:jmBr3balBclw29DXaPB2J9ot3nPIGX30caGhDgGCcc4Go0ER5IY0ms41:jmBrrDDX0tXT30vzHF4Go0+Fs41

Score

10^/10

GandCrab payload 2 IoCs

resource	yara_rule
behavioral2/memory/4932-3-0x0000000000400000-0x0000000000E86000-memory.dmp	family_gandcrab
behavioral2/memory/4932-4-0x0000000000F10000-0x0000000000F26000-memory.dmp	family_gandcrab

Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2912	4932	WerFault.exe	83

C:\Users\Admin\AppData\Local\Temp\9fad3216d8d89939f2e8849cf1a8dff5_mafia_magniber_JC.exe
"C:\Users\Admin\AppData\Local\Temp\9fad3216d8d89939f2e8849cf1a8dff5_mafia_magniber_JC.exe"
1⤵
PID:4932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 460
  2⤵
  - Program crash
  PID:2912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4932 -ip 4932
1⤵
PID:700

memory/4932-1-0x0000000001050000-0x0000000001150000-memory.dmp

Filesize
1024KB

Download
memory/4932-3-0x0000000000400000-0x0000000000E86000-memory.dmp

Filesize
10.5MB

Download
memory/4932-4-0x0000000000F10000-0x0000000000F26000-memory.dmp

Filesize
88KB

Download
memory/4932-7-0x0000000001050000-0x0000000001150000-memory.dmp

Filesize
1024KB

Download