Analysis
-
max time kernel
154s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
25-01-2024 17:33
General
-
Target
2024-01-25_91b1ba3cdf65c4eb41158a8e88dfe81a_gandcrab.exe
-
Size
70KB
-
MD5
91b1ba3cdf65c4eb41158a8e88dfe81a
-
SHA1
f470dffc065e426e0b146bc32abb91ca67704b55
-
SHA256
0b6e7ea3e1a0aebfdbb1283cadd5492f0e1776c303beb2d8f4cc78b4a7dfe824
-
SHA512
4585d223ab14acda1d2fa63c4653d2aaf23e8d5850cc255e0d1846e689f647f8f6a29344926e9900ff8ef82a39deecc9a572d82187569cc95aef1941b40bd3db
-
SSDEEP
1536:3ZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:ed5BJHMqqDL2/Ovvdr
Score
10/10
Malware Config
Signatures
-
Kinsing
Kinsing is a loader written in Golang.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_91b1ba3cdf65c4eb41158a8e88dfe81a_gandcrab.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_91b1ba3cdf65c4eb41158a8e88dfe81a_gandcrab.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses