Analysis
- max time kernel
154s - max time network
161s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
25/01/2024, 17:33
General
- Target 2024-01-25_91b1ba3cdf65c4eb41158a8e88dfe81a_gandcrab.exe
- Size 70KB
- Sample240125-v4v43acfdr
- SHA256 0b6e7ea3e1a0aebfdbb1283cadd5492f0e1776c303beb2d8f4cc78b4a7dfe824
Score
10/10
Malware Config
Signatures
- Kinsing
Kinsing is a loader written in Golang.
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_91b1ba3cdf65c4eb41158a8e88dfe81a_gandcrab.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_91b1ba3cdf65c4eb41158a8e88dfe81a_gandcrab.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses