Analysis
-
max time kernel
140s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
04-02-2024 14:32
General
-
Target
2024-02-04_8af1162e9d8760024d4c50aa2269cc40_karagany_mafia.exe
-
Size
257KB
-
MD5
8af1162e9d8760024d4c50aa2269cc40
-
SHA1
d05745eeee000100b4c59c3473c5f55aed5198db
-
SHA256
30469e49b7acf3718af1b2a58def19b2c1ba1e53e151baf41bec73af79ed14c4
-
SHA512
49be2c62c89306268de33b2ab321367a32d0144c8a2b5f00c0d5600d20d71227ec9461918841d23e76851b1d80849420d9d8c0133f6c1bd510bed4a8bb6a8bbe
-
SSDEEP
6144:5JvXbVklS/zDiWsg4Ig1ubxq6ckd+QWm5iGgw3Yx:DVklS/qHg4EbVckYBJGT3Yx
Score
10/10
Malware Config
Signatures
-
GandCrab payload 2 IoCs
-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Detects Reflective DLL injection artifacts 2 IoCs
-
Detects ransomware indicator 2 IoCs
-
Gandcrab Payload 2 IoCs
-
Program crash 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-04_8af1162e9d8760024d4c50aa2269cc40_karagany_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-04_8af1162e9d8760024d4c50aa2269cc40_karagany_mafia.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3508 -s 4682⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3508 -ip 35081⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
92KB
-
Filesize
108KB