gandcrab | 764856f2105fb5a1b3d536e6229f2059c806a56fb4e964a6370bb43ecc2713b2

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
28/08/2023, 18:21

Target

c5a25b2eaa3dc9c363d24d518936d701_mafia_JC.exe
Size

308KB
MD5

c5a25b2eaa3dc9c363d24d518936d701
SHA1

9e3e516c3ce8f50ca7df7836bdb6e2d176c5fb70
SHA256

764856f2105fb5a1b3d536e6229f2059c806a56fb4e964a6370bb43ecc2713b2
SHA512

cfdede43fdc3414a057e364f0d72451a377ad16bbbebd47e32eaceaf2c67ee48433326c8945d739063e2e28522f031ec7fc18131ce6ddaa3ec1cab81fa20487f
SSDEEP

6144:UzL7ShWDLVzVNam6GxI29dqG3KdYAYqTuPZp:iDHNam62ZdKmZmuPH

Score

10^/10

GandCrab payload 2 IoCs

resource	yara_rule
behavioral2/memory/1832-2-0x0000000000400000-0x0000000001400000-memory.dmp	family_gandcrab
behavioral2/memory/1832-3-0x000000000C5F0000-0x000000000C607000-memory.dmp	family_gandcrab

Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3184	1832	WerFault.exe	80

C:\Users\Admin\AppData\Local\Temp\c5a25b2eaa3dc9c363d24d518936d701_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\c5a25b2eaa3dc9c363d24d518936d701_mafia_JC.exe"
1⤵
PID:1832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 488
  2⤵
  - Program crash
  PID:3184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1832 -ip 1832
1⤵
PID:4720

memory/1832-1-0x000000000AB50000-0x000000000AC50000-memory.dmp

Filesize
1024KB

Download
memory/1832-2-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1832-3-0x000000000C5F0000-0x000000000C607000-memory.dmp

Filesize
92KB

Download