Analysis
-
max time kernel
93s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
01/02/2024, 15:28
General
-
Target
2024-02-01_5b1769924a648f8814b43455a8f61fc9_karagany_mafia.exe
-
Size
250KB
-
MD5
5b1769924a648f8814b43455a8f61fc9
-
SHA1
197d55a229ea95e672a9ee53d253135c6f438d87
-
SHA256
10ead387bfa669a3e3452e832eed13cd8a6a35656c35971116ec9892ff1b1208
-
SHA512
a377fe0b3b45b65eebd3fac1eb41e0d12b1c6f6cdf0cfb5a3f9cea176d467af8796d38823c12ed2d4e0ccbbd1c8b361951d494a596bc4893dce71b7587791f36
-
SSDEEP
6144:V+YrOIBjaklexBgiJ8sTSIkIpxIp8mDtfPBRwasxXq:1OCjaklYgVIpxIhDtR
Score
10/10
Malware Config
Signatures
-
GandCrab payload 2 IoCs
-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Detects Reflective DLL injection artifacts 2 IoCs
-
Detects ransomware indicator 2 IoCs
-
Gandcrab Payload 2 IoCs
-
Program crash 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-01_5b1769924a648f8814b43455a8f61fc9_karagany_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-01_5b1769924a648f8814b43455a8f61fc9_karagany_mafia.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 4682⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2660 -ip 26601⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
272KB
-
Filesize
272KB
-
Filesize
92KB
-
Filesize
108KB