Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
07/01/2024, 19:37
Static task
static1
Behavioral task
behavioral1
Sample
20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe
Resource
win10v2004-20231215-en
General
-
Target
20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe
-
Size
308KB
-
MD5
e81cae4878089f0159d996a7b752d43a
-
SHA1
686111f583d1108e012c304178510cb06c02e096
-
SHA256
260d50a39fda670c35002720c733496c0e0a67714727c8a286c2f6b7e5f68e38
-
SHA512
54cfb2a3004a51d16e09486f61d6c4f59014996439ea31c30e3b6f34f4bf4607dc1590479f6665d1665394f21029ab62e253341d5302535eb682be9fff20af72
-
SSDEEP
6144:bzL7ShWDLVzVNam6GxI29dqG3KdYAYqTuPZp:JDHNam62ZdKmZmuPH
Malware Config
Signatures
-
GandCrab payload 4 IoCs
resource yara_rule behavioral1/memory/1944-2-0x0000000000400000-0x0000000001400000-memory.dmp family_gandcrab behavioral1/memory/1944-3-0x00000000002B0000-0x00000000002C7000-memory.dmp family_gandcrab behavioral1/memory/1944-10-0x0000000000400000-0x0000000001400000-memory.dmp family_gandcrab behavioral1/memory/1944-13-0x00000000002B0000-0x00000000002C7000-memory.dmp family_gandcrab -
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dhymcmgiizu = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\hdkpqa.exe\"" 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe File opened (read-only) \??\P: 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe File opened (read-only) \??\S: 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe File opened (read-only) \??\V: 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe File opened (read-only) \??\A: 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe File opened (read-only) \??\J: 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe File opened (read-only) \??\N: 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe File opened (read-only) \??\M: 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe File opened (read-only) \??\Q: 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe File opened (read-only) \??\R: 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe File opened (read-only) \??\U: 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe File opened (read-only) \??\W: 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe File opened (read-only) \??\B: 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe File opened (read-only) \??\I: 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe File opened (read-only) \??\L: 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe File opened (read-only) \??\Z: 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe File opened (read-only) \??\O: 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe File opened (read-only) \??\T: 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe File opened (read-only) \??\X: 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe File opened (read-only) \??\Y: 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe File opened (read-only) \??\E: 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe File opened (read-only) \??\G: 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe File opened (read-only) \??\H: 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1944 wrote to memory of 2840 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 28 PID 1944 wrote to memory of 2840 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 28 PID 1944 wrote to memory of 2840 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 28 PID 1944 wrote to memory of 2840 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 28 PID 1944 wrote to memory of 2676 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 31 PID 1944 wrote to memory of 2676 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 31 PID 1944 wrote to memory of 2676 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 31 PID 1944 wrote to memory of 2676 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 31 PID 1944 wrote to memory of 2468 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 33 PID 1944 wrote to memory of 2468 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 33 PID 1944 wrote to memory of 2468 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 33 PID 1944 wrote to memory of 2468 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 33 PID 1944 wrote to memory of 2516 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 35 PID 1944 wrote to memory of 2516 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 35 PID 1944 wrote to memory of 2516 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 35 PID 1944 wrote to memory of 2516 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 35 PID 1944 wrote to memory of 2592 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 36 PID 1944 wrote to memory of 2592 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 36 PID 1944 wrote to memory of 2592 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 36 PID 1944 wrote to memory of 2592 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 36 PID 1944 wrote to memory of 2684 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 38 PID 1944 wrote to memory of 2684 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 38 PID 1944 wrote to memory of 2684 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 38 PID 1944 wrote to memory of 2684 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 38 PID 1944 wrote to memory of 1712 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 40 PID 1944 wrote to memory of 1712 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 40 PID 1944 wrote to memory of 1712 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 40 PID 1944 wrote to memory of 1712 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 40 PID 1944 wrote to memory of 1600 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 44 PID 1944 wrote to memory of 1600 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 44 PID 1944 wrote to memory of 1600 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 44 PID 1944 wrote to memory of 1600 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 44 PID 1944 wrote to memory of 1016 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 47 PID 1944 wrote to memory of 1016 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 47 PID 1944 wrote to memory of 1016 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 47 PID 1944 wrote to memory of 1016 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 47 PID 1944 wrote to memory of 2724 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 49 PID 1944 wrote to memory of 2724 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 49 PID 1944 wrote to memory of 2724 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 49 PID 1944 wrote to memory of 2724 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 49 PID 1944 wrote to memory of 2484 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 51 PID 1944 wrote to memory of 2484 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 51 PID 1944 wrote to memory of 2484 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 51 PID 1944 wrote to memory of 2484 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 51 PID 1944 wrote to memory of 1020 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 53 PID 1944 wrote to memory of 1020 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 53 PID 1944 wrote to memory of 1020 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 53 PID 1944 wrote to memory of 1020 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 53 PID 1944 wrote to memory of 2168 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 54 PID 1944 wrote to memory of 2168 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 54 PID 1944 wrote to memory of 2168 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 54 PID 1944 wrote to memory of 2168 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 54 PID 1944 wrote to memory of 564 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 57 PID 1944 wrote to memory of 564 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 57 PID 1944 wrote to memory of 564 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 57 PID 1944 wrote to memory of 564 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 57 PID 1944 wrote to memory of 1988 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 59 PID 1944 wrote to memory of 1988 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 59 PID 1944 wrote to memory of 1988 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 59 PID 1944 wrote to memory of 1988 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 59 PID 1944 wrote to memory of 2132 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 60 PID 1944 wrote to memory of 2132 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 60 PID 1944 wrote to memory of 2132 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 60 PID 1944 wrote to memory of 2132 1944 20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe 60
Processes
-
C:\Users\Admin\AppData\Local\Temp\20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe"C:\Users\Admin\AppData\Local\Temp\20240106e81cae4878089f0159d996a7b752d43akaraganymafia.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2840
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2676
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2468
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2516
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2592
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2684
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1712
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1600
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1016
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2724
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2484
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1020
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2168
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:564
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1988
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2132
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2712
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2824
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2248
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2104
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2376
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:1532
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:3020
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:864
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1376
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2392
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1448
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:908
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2040
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2032
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2232
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1164
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1544
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:1260
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2204
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1716
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2808
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2752
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2632
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2568
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2532
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2688
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:340
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:524
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2700
-