Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
07/01/2024, 19:20
Static task
static1
Behavioral task
behavioral1
Sample
202401069fee02cc173f13d9435843111f039653karaganymafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
202401069fee02cc173f13d9435843111f039653karaganymafia.exe
Resource
win10v2004-20231215-en
General
-
Target
202401069fee02cc173f13d9435843111f039653karaganymafia.exe
-
Size
308KB
-
MD5
9fee02cc173f13d9435843111f039653
-
SHA1
c5ea1fd35c1e94de3ac56e945b1880d1b46d2c59
-
SHA256
80e7f21baba6ca6b8ff2a8621204f3cc1ab892511a293cb0056656ab9d0e3f80
-
SHA512
00251e2beab09d093dee5e11de1afe26d02f10db6acb6ec313df904d4f367b96f0359137d2d40efff2520499c81c8a132b9a90bb053668007093d70b48e0cf4d
-
SSDEEP
6144:JzL7ShWDLVzVNam6GxI29dqG3KdYAYqTuPZp:XDHNam62ZdKmZmuPH
Malware Config
Signatures
-
GandCrab payload 4 IoCs
resource yara_rule behavioral1/memory/3040-2-0x0000000000400000-0x0000000001400000-memory.dmp family_gandcrab behavioral1/memory/3040-3-0x0000000000220000-0x0000000000237000-memory.dmp family_gandcrab behavioral1/memory/3040-10-0x0000000000400000-0x0000000001400000-memory.dmp family_gandcrab behavioral1/memory/3040-13-0x0000000000220000-0x0000000000237000-memory.dmp family_gandcrab -
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 104.155.138.21 Destination IP 107.178.223.183 Destination IP 104.155.138.21 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 107.178.223.183 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 107.178.223.183 Destination IP 104.155.138.21 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 107.178.223.183 Destination IP 104.155.138.21 Destination IP 107.178.223.183 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 104.155.138.21 Destination IP 107.178.223.183 Destination IP 104.155.138.21 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zdeedyjebrm = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\qelqwi.exe\"" 202401069fee02cc173f13d9435843111f039653karaganymafia.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: 202401069fee02cc173f13d9435843111f039653karaganymafia.exe File opened (read-only) \??\I: 202401069fee02cc173f13d9435843111f039653karaganymafia.exe File opened (read-only) \??\N: 202401069fee02cc173f13d9435843111f039653karaganymafia.exe File opened (read-only) \??\P: 202401069fee02cc173f13d9435843111f039653karaganymafia.exe File opened (read-only) \??\X: 202401069fee02cc173f13d9435843111f039653karaganymafia.exe File opened (read-only) \??\Y: 202401069fee02cc173f13d9435843111f039653karaganymafia.exe File opened (read-only) \??\E: 202401069fee02cc173f13d9435843111f039653karaganymafia.exe File opened (read-only) \??\G: 202401069fee02cc173f13d9435843111f039653karaganymafia.exe File opened (read-only) \??\K: 202401069fee02cc173f13d9435843111f039653karaganymafia.exe File opened (read-only) \??\L: 202401069fee02cc173f13d9435843111f039653karaganymafia.exe File opened (read-only) \??\U: 202401069fee02cc173f13d9435843111f039653karaganymafia.exe File opened (read-only) \??\W: 202401069fee02cc173f13d9435843111f039653karaganymafia.exe File opened (read-only) \??\H: 202401069fee02cc173f13d9435843111f039653karaganymafia.exe File opened (read-only) \??\O: 202401069fee02cc173f13d9435843111f039653karaganymafia.exe File opened (read-only) \??\Q: 202401069fee02cc173f13d9435843111f039653karaganymafia.exe File opened (read-only) \??\Z: 202401069fee02cc173f13d9435843111f039653karaganymafia.exe File opened (read-only) \??\B: 202401069fee02cc173f13d9435843111f039653karaganymafia.exe File opened (read-only) \??\J: 202401069fee02cc173f13d9435843111f039653karaganymafia.exe File opened (read-only) \??\M: 202401069fee02cc173f13d9435843111f039653karaganymafia.exe File opened (read-only) \??\R: 202401069fee02cc173f13d9435843111f039653karaganymafia.exe File opened (read-only) \??\S: 202401069fee02cc173f13d9435843111f039653karaganymafia.exe File opened (read-only) \??\T: 202401069fee02cc173f13d9435843111f039653karaganymafia.exe File opened (read-only) \??\V: 202401069fee02cc173f13d9435843111f039653karaganymafia.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 202401069fee02cc173f13d9435843111f039653karaganymafia.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 202401069fee02cc173f13d9435843111f039653karaganymafia.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 202401069fee02cc173f13d9435843111f039653karaganymafia.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3040 wrote to memory of 2676 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 28 PID 3040 wrote to memory of 2676 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 28 PID 3040 wrote to memory of 2676 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 28 PID 3040 wrote to memory of 2676 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 28 PID 3040 wrote to memory of 2836 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 30 PID 3040 wrote to memory of 2836 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 30 PID 3040 wrote to memory of 2836 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 30 PID 3040 wrote to memory of 2836 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 30 PID 3040 wrote to memory of 2824 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 32 PID 3040 wrote to memory of 2824 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 32 PID 3040 wrote to memory of 2824 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 32 PID 3040 wrote to memory of 2824 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 32 PID 3040 wrote to memory of 2964 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 34 PID 3040 wrote to memory of 2964 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 34 PID 3040 wrote to memory of 2964 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 34 PID 3040 wrote to memory of 2964 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 34 PID 3040 wrote to memory of 2772 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 36 PID 3040 wrote to memory of 2772 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 36 PID 3040 wrote to memory of 2772 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 36 PID 3040 wrote to memory of 2772 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 36 PID 3040 wrote to memory of 2572 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 38 PID 3040 wrote to memory of 2572 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 38 PID 3040 wrote to memory of 2572 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 38 PID 3040 wrote to memory of 2572 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 38 PID 3040 wrote to memory of 1480 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 42 PID 3040 wrote to memory of 1480 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 42 PID 3040 wrote to memory of 1480 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 42 PID 3040 wrote to memory of 1480 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 42 PID 3040 wrote to memory of 1472 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 44 PID 3040 wrote to memory of 1472 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 44 PID 3040 wrote to memory of 1472 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 44 PID 3040 wrote to memory of 1472 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 44 PID 3040 wrote to memory of 1192 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 46 PID 3040 wrote to memory of 1192 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 46 PID 3040 wrote to memory of 1192 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 46 PID 3040 wrote to memory of 1192 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 46 PID 3040 wrote to memory of 2920 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 48 PID 3040 wrote to memory of 2920 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 48 PID 3040 wrote to memory of 2920 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 48 PID 3040 wrote to memory of 2920 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 48 PID 3040 wrote to memory of 2944 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 50 PID 3040 wrote to memory of 2944 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 50 PID 3040 wrote to memory of 2944 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 50 PID 3040 wrote to memory of 2944 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 50 PID 3040 wrote to memory of 1720 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 52 PID 3040 wrote to memory of 1720 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 52 PID 3040 wrote to memory of 1720 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 52 PID 3040 wrote to memory of 1720 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 52 PID 3040 wrote to memory of 2000 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 54 PID 3040 wrote to memory of 2000 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 54 PID 3040 wrote to memory of 2000 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 54 PID 3040 wrote to memory of 2000 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 54 PID 3040 wrote to memory of 2180 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 56 PID 3040 wrote to memory of 2180 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 56 PID 3040 wrote to memory of 2180 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 56 PID 3040 wrote to memory of 2180 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 56 PID 3040 wrote to memory of 1496 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 58 PID 3040 wrote to memory of 1496 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 58 PID 3040 wrote to memory of 1496 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 58 PID 3040 wrote to memory of 1496 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 58 PID 3040 wrote to memory of 1584 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 60 PID 3040 wrote to memory of 1584 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 60 PID 3040 wrote to memory of 1584 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 60 PID 3040 wrote to memory of 1584 3040 202401069fee02cc173f13d9435843111f039653karaganymafia.exe 60
Processes
-
C:\Users\Admin\AppData\Local\Temp\202401069fee02cc173f13d9435843111f039653karaganymafia.exe"C:\Users\Admin\AppData\Local\Temp\202401069fee02cc173f13d9435843111f039653karaganymafia.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2676
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2836
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2824
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2964
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2772
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2572
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1480
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1472
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1192
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2920
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2944
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1720
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2000
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2180
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1496
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1584
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2420
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:1528
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:324
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1960
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:716
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2132
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2256
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2880
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:968
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:1816
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:804
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1884
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2096
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:876
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:852
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1100
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1600
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:3052
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1108
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2720
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2840
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2600
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2612
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2844
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:552
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2552
-