gandcrab | 5a001e54aff96a319be1b92eeeaedfb73ee22c731b643241a6ac9627cd377e47

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 19:19

Target

20240106814a1591de36661fb161e4d5ae7d5a82karaganymafia.exe
Size

308KB
MD5

814a1591de36661fb161e4d5ae7d5a82
SHA1

124e51616183a3448052310b6126d8f8f59baeeb
SHA256

5a001e54aff96a319be1b92eeeaedfb73ee22c731b643241a6ac9627cd377e47
SHA512

3adb1032699162839a866ee80de78dc2db13b43282455fe1c80e5f4278a8888ac2fb435f08cfddd1907b73f23f42064e0b0e41d3320d2c929ff2884c64fd4f1a
SSDEEP

6144:ZzL7ShWDLVzVNam6GxI29dqG3KdYAYqTuPZp:nDHNam62ZdKmZmuPH

Score

10^/10

GandCrab payload 2 IoCs

resource	yara_rule
behavioral2/memory/4156-2-0x0000000000400000-0x0000000001400000-memory.dmp	family_gandcrab
behavioral2/memory/4156-3-0x000000000AC80000-0x000000000AC97000-memory.dmp	family_gandcrab

Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1956	4156	WerFault.exe	80

C:\Users\Admin\AppData\Local\Temp\20240106814a1591de36661fb161e4d5ae7d5a82karaganymafia.exe
"C:\Users\Admin\AppData\Local\Temp\20240106814a1591de36661fb161e4d5ae7d5a82karaganymafia.exe"
1⤵
PID:4156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 484
  2⤵
  - Program crash
  PID:1956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4156 -ip 4156
1⤵
PID:368

memory/4156-1-0x000000000AD00000-0x000000000AE00000-memory.dmp

Filesize
1024KB

Download
memory/4156-2-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/4156-3-0x000000000AC80000-0x000000000AC97000-memory.dmp

Filesize
92KB

Download