Overview

overview

10

Static

static

3

NEAS.2023-...JC.exe

windows7-x64

10

NEAS.2023-...JC.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    128s
  • max time network
    163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-10-2023 19:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    NEAS.2023-09-06_c71c2f157263582f3c309964eba9c3eb_gandcrab_JC.exe

  • Size

    170KB

  • MD5

    c71c2f157263582f3c309964eba9c3eb

  • SHA1

    69e0931306b4372ecf0af62db0d507ed3de017bb

  • SHA256

    89001b29d518ee1f49fcf96169e8f8f52b47c22ed44a52fd5dfd30bd952e6938

  • SHA512

    12717ff4cc1a4b286e0ad9f464eb9a69bb13a99ffa31deab8e09141629e7ea47422b63aacf8d8cb925bd98a94daf79418803433a5e53ece282d210d809457bcc

  • SSDEEP

    3072:URPI6YetSOYyM1PUVDAWpcB3/Az/O9xn6Ln+q7E/kfTOQ5N:URNYmSlPdOO3/Y/Wyh7B7OQn

Score
10/10
gandcrabbackdoorransomware

Malware Config

Signatures

  • GandCrab payload 3 IoCs
  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab
  • Program crash 1 IoCs
  • Suspicious use of SetWindowsHookAW 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-06_c71c2f157263582f3c309964eba9c3eb_gandcrab_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-06_c71c2f157263582f3c309964eba9c3eb_gandcrab_JC.exe"
    1⤵
    • Suspicious use of SetWindowsHookAW
    PID:1684
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 460
      2⤵
      • Program crash
      PID:4272
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1684 -ip 1684
    1⤵
      PID:3744

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1684-1-0x0000000000520000-0x0000000000620000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/1684-3-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

      Download

    • memory/1684-2-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

      Download

    • memory/1684-4-0x0000000000520000-0x0000000000620000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/1684-7-0x0000000002350000-0x0000000002367000-memory.dmp

      Filesize

      92KB

      Download