Analysis
-
max time kernel
139s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
18/01/2024, 22:38
General
-
Target
2024-01-18_39751bc065326d9d1c15a84bc7e6428f_karagany_mafia.exe
-
Size
250KB
-
MD5
39751bc065326d9d1c15a84bc7e6428f
-
SHA1
011bef827ba7c1532146f25b12ffc5990f6a05e4
-
SHA256
166b8531c2ddc15c29db95e33228f2550efe232b867e3d50037f73dd5f870806
-
SHA512
1328e3ac1fe5a52dd6f8d395d2b0d2346d9b08cfd935791f0be3b653151b1f4b0f86963372307d795c430e8a97efcbd00f7a49fcb22497f8751704980405153b
-
SSDEEP
6144:L+YrOIBjaklexBgiJ8sTSIkIpxIp8mDtfPBRwasxXq:/OCjaklYgVIpxIhDtR
Score
10/10
Malware Config
Signatures
-
GandCrab payload 2 IoCs
-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Detects Reflective DLL injection artifacts 2 IoCs
-
Detects ransomware indicator 2 IoCs
-
Gandcrab Payload 2 IoCs
-
Program crash 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-18_39751bc065326d9d1c15a84bc7e6428f_karagany_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-18_39751bc065326d9d1c15a84bc7e6428f_karagany_mafia.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 4722⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4304 -ip 43041⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
272KB
-
Filesize
272KB
-
Filesize
92KB
-
Filesize
108KB