gandcrab | be25b9fee57ac389d1fed0cc460bedbe38632af6f7480ddc3bae8280991d892f

Analysis

max time kernel
144s
max time network
67s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2024, 06:44

Target

2024-01-08_8c7b2acef3b04a2a9258f596c913d7b3_karagany_mafia.exe
Size

308KB
MD5

8c7b2acef3b04a2a9258f596c913d7b3
SHA1

edc368422b0c11ef909e73799545394235a4dc97
SHA256

be25b9fee57ac389d1fed0cc460bedbe38632af6f7480ddc3bae8280991d892f
SHA512

424019ff5a8c34057e9f68b497f7e104bd4de4b95d13fa1d3ab06ca2fb957fda90fbe058b18017b1e0b8932bf618e67b6d23b4c8ac2bce5497fe17c840c751ae
SSDEEP

6144:uzL7ShWDLVzVNam6GxI29dqG3KdYAYqTuPZp:sDHNam62ZdKmZmuPH

Score

10^/10

GandCrab payload 2 IoCs

resource	yara_rule
behavioral2/memory/3364-3-0x000000000C720000-0x000000000C737000-memory.dmp	family_gandcrab
behavioral2/memory/3364-2-0x0000000000400000-0x0000000001400000-memory.dmp	family_gandcrab

Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2500	3364	WerFault.exe	14

C:\Users\Admin\AppData\Local\Temp\2024-01-08_8c7b2acef3b04a2a9258f596c913d7b3_karagany_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-08_8c7b2acef3b04a2a9258f596c913d7b3_karagany_mafia.exe"
1⤵
PID:3364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 488
  2⤵
  - Program crash
  PID:2500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3364 -ip 3364
1⤵
PID:4944

memory/3364-1-0x000000000A9E0000-0x000000000AAE0000-memory.dmp

Filesize
1024KB

Download
memory/3364-3-0x000000000C720000-0x000000000C737000-memory.dmp

Filesize
92KB

Download
memory/3364-2-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download