Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
15-09-2023 17:20
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe
-
Size
250KB
-
MD5
dc05502d3f3f90fff8f238acd1968b37
-
SHA1
687eaed7a2ea82eb8cf52e50464318aef6fa8be1
-
SHA256
585099816a6edd82a0a8c7495d164595910782e9c640cc55a96863b9239c0fdc
-
SHA512
e8f064da02e37174b677c7ed2a0c3c90f95208ff82f0d7e3d3a64ffd276104b87b66a9af2d389f8006af979ea3bbb2e3c51d35409a82bb25b605381a628520c5
-
SSDEEP
3072:D/yK5d0Gj0+nY3uEBLvBNfdUR2/qFnB8o2+vU3WuvIBuj00nReaXkuSQ7cdOd3:D/y20Gj0r+EBFrkvlU3RvIUDOIN
Malware Config
Signatures
-
GandCrab payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2180-5-0x00000000001B0000-0x00000000001C7000-memory.dmp family_gandcrab behavioral1/memory/2180-4-0x0000000000400000-0x0000000000444000-memory.dmp family_gandcrab behavioral1/memory/2180-13-0x0000000000400000-0x0000000000444000-memory.dmp family_gandcrab behavioral1/memory/2180-15-0x00000000001B0000-0x00000000001C7000-memory.dmp family_gandcrab -
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 Destination IP 35.205.61.67 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fptgunxbxia = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\gzhboe.exe\"" 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exedescription ioc process File opened (read-only) \??\H: 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe File opened (read-only) \??\L: 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe File opened (read-only) \??\P: 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe File opened (read-only) \??\S: 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe File opened (read-only) \??\W: 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe File opened (read-only) \??\A: 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe File opened (read-only) \??\B: 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe File opened (read-only) \??\R: 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe File opened (read-only) \??\Y: 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe File opened (read-only) \??\K: 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe File opened (read-only) \??\N: 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe File opened (read-only) \??\O: 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe File opened (read-only) \??\Q: 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe File opened (read-only) \??\T: 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe File opened (read-only) \??\V: 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe File opened (read-only) \??\Z: 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe File opened (read-only) \??\E: 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe File opened (read-only) \??\I: 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe File opened (read-only) \??\M: 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe File opened (read-only) \??\U: 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe File opened (read-only) \??\X: 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe File opened (read-only) \??\G: 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe File opened (read-only) \??\J: 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exepid process 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe -
Suspicious use of WriteProcessMemory 52 IoCs
Processes:
2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exedescription pid process target process PID 2180 wrote to memory of 2740 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2740 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2740 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2740 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2748 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2748 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2748 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2748 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2644 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2644 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2644 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2644 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2568 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2568 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2568 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2568 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2172 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2172 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2172 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2172 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 1728 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 1728 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 1728 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 1728 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2932 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2932 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2932 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2932 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2972 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2972 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2972 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2972 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 1816 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 1816 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 1816 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 1816 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2820 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2820 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2820 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2820 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2884 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2884 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2884 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2884 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2628 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2628 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2628 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2628 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2852 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2852 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2852 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe PID 2180 wrote to memory of 2852 2180 2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe nslookup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-25_dc05502d3f3f90fff8f238acd1968b37_mafia_JC.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2740
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2748
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2644
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2568
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2172
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:1728
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2932
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2972
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1816
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2820
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2884
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2628
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2852