Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
23/01/2024, 19:48
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe
-
Size
351KB
-
MD5
af020ff4838f9a9f6104c8b69e1c8234
-
SHA1
8fe5c7a98bf06006b682a9a72008b13815e8dc1a
-
SHA256
882c8cdecc36a2ee23097d27dea0c0eb47ac907abce1ebac353f81ca38c0eeaf
-
SHA512
6e753000dbe47a5b075d48356f5478b0df5ffd7b0fdf85b2673238e0087893527ba2b767da5f883e16a582714cc63a1aafdc6a2dad092c3a9b9f8ef4f63beed2
-
SSDEEP
3072:U9pNMs+Kr1wbWGjl0xjsNNeVKBNVBxKT46xl+wndfIQQOaC3QBn7/hsb2BhGZ1/N:U9pNMsLWEjsXjBATRpuuwnGD/Nj6a
Malware Config
Signatures
-
GandCrab payload 3 IoCs
resource yara_rule behavioral2/memory/1568-3-0x0000000000400000-0x00000000012D6000-memory.dmp family_gandcrab behavioral2/memory/1568-4-0x0000000003040000-0x0000000003057000-memory.dmp family_gandcrab behavioral2/memory/1568-11-0x0000000003040000-0x0000000003057000-memory.dmp family_gandcrab -
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Detects Reflective DLL injection artifacts 3 IoCs
resource yara_rule behavioral2/memory/1568-3-0x0000000000400000-0x00000000012D6000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral2/memory/1568-4-0x0000000003040000-0x0000000003057000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral2/memory/1568-11-0x0000000003040000-0x0000000003057000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader -
Detects ransomware indicator 2 IoCs
resource yara_rule behavioral2/memory/1568-4-0x0000000003040000-0x0000000003057000-memory.dmp SUSP_RANSOMWARE_Indicator_Jul20 behavioral2/memory/1568-11-0x0000000003040000-0x0000000003057000-memory.dmp SUSP_RANSOMWARE_Indicator_Jul20 -
Gandcrab Payload 3 IoCs
resource yara_rule behavioral2/memory/1568-3-0x0000000000400000-0x00000000012D6000-memory.dmp Gandcrab behavioral2/memory/1568-4-0x0000000003040000-0x0000000003057000-memory.dmp Gandcrab behavioral2/memory/1568-11-0x0000000003040000-0x0000000003057000-memory.dmp Gandcrab -
Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\mhqpblogbmm = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\ydspnl.exe\"" 2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe File opened (read-only) \??\G: 2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe File opened (read-only) \??\K: 2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe File opened (read-only) \??\L: 2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe File opened (read-only) \??\O: 2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe File opened (read-only) \??\U: 2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe File opened (read-only) \??\A: 2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe File opened (read-only) \??\B: 2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe File opened (read-only) \??\X: 2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe File opened (read-only) \??\Y: 2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe File opened (read-only) \??\Z: 2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe File opened (read-only) \??\H: 2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe File opened (read-only) \??\M: 2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe File opened (read-only) \??\S: 2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe File opened (read-only) \??\T: 2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe File opened (read-only) \??\V: 2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe File opened (read-only) \??\W: 2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe File opened (read-only) \??\I: 2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe File opened (read-only) \??\J: 2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe File opened (read-only) \??\N: 2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe File opened (read-only) \??\P: 2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe File opened (read-only) \??\Q: 2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe File opened (read-only) \??\R: 2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4772 1568 WerFault.exe 12 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1568 2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe 1568 2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe 1568 2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe 1568 2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1568 wrote to memory of 3472 1568 2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe 93 PID 1568 wrote to memory of 3472 1568 2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe 93 PID 1568 wrote to memory of 3472 1568 2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe 93 PID 1568 wrote to memory of 2840 1568 2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe 95 PID 1568 wrote to memory of 2840 1568 2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe 95 PID 1568 wrote to memory of 2840 1568 2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-23_af020ff4838f9a9f6104c8b69e1c8234_mafia.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:3472
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2840
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 13762⤵
- Program crash
PID:4772
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1568 -ip 15681⤵PID:3776