gandcrab | 56e2e608819021b8e1ca387a632badca9b8f9181bbef9697bbe8d5b943b6d5df

Analysis

max time kernel
138s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03-02-2024 11:41

Target

2024-02-03_f0b4a4b54646c423a147a6b4af90eb1c_karagany_mafia.exe
Size

250KB
MD5

f0b4a4b54646c423a147a6b4af90eb1c
SHA1

a4128ba875b1e81387710c108e82f8fa348623c6
SHA256

56e2e608819021b8e1ca387a632badca9b8f9181bbef9697bbe8d5b943b6d5df
SHA512

386b10715db93e3a3648f095e17cd188d8c017c4f740aeabafc4896254747c499f18fbf50bc55a41201b958a52ffef877d49241ccbefafa663b66b9a5fd32fc7
SSDEEP

3072:c/yK5d0Gj0+nY3uEBLvBNfdUR2/qFnB8o2+vU3WuvIBuj00nReaXkuSQ7cdOd3:c/y20Gj0r+EBFrkvlU3RvIUDOIN

Score

10^/10

GandCrab payload 2 IoCs

resource	yara_rule
behavioral2/memory/4664-4-0x0000000000400000-0x0000000000444000-memory.dmp	family_gandcrab
behavioral2/memory/4664-6-0x0000000000720000-0x0000000000737000-memory.dmp	family_gandcrab

Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab

Detects Reflective DLL injection artifacts 2 IoCs

resource	yara_rule
behavioral2/memory/4664-4-0x0000000000400000-0x0000000000444000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/memory/4664-6-0x0000000000720000-0x0000000000737000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects ransomware indicator 2 IoCs

resource	yara_rule
behavioral2/memory/4664-4-0x0000000000400000-0x0000000000444000-memory.dmp	SUSP_RANSOMWARE_Indicator_Jul20
behavioral2/memory/4664-6-0x0000000000720000-0x0000000000737000-memory.dmp	SUSP_RANSOMWARE_Indicator_Jul20

Gandcrab Payload 2 IoCs

resource	yara_rule
behavioral2/memory/4664-4-0x0000000000400000-0x0000000000444000-memory.dmp	Gandcrab
behavioral2/memory/4664-6-0x0000000000720000-0x0000000000737000-memory.dmp	Gandcrab

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1212	4664	WerFault.exe	62

C:\Users\Admin\AppData\Local\Temp\2024-02-03_f0b4a4b54646c423a147a6b4af90eb1c_karagany_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-03_f0b4a4b54646c423a147a6b4af90eb1c_karagany_mafia.exe"
1⤵
PID:4664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 468
  2⤵
  - Program crash
  PID:1212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4664 -ip 4664
1⤵
PID:3708

memory/4664-2-0x0000000000760000-0x0000000000860000-memory.dmp

Filesize
1024KB

Download
memory/4664-3-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4664-4-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4664-6-0x0000000000720000-0x0000000000737000-memory.dmp

Filesize
92KB

Download