gandcrab | 87bea22a20270d91e575299c1a0f647b4c30a9f1ac8f060fff4b219e15560719

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 07:41

Target

2024-02-12_6496653e6c982ee0b078565e27998335_karagany_mafia.exe
Size

327KB
MD5

6496653e6c982ee0b078565e27998335
SHA1

ed6f230e87d8cdafaf5502829e6d577cd94a31dd
SHA256

87bea22a20270d91e575299c1a0f647b4c30a9f1ac8f060fff4b219e15560719
SHA512

7af11b3f86586c470c5296fc757f9a2f1023facd9187d3e15e65639e09635a9dd7b7dcd5d6bc0b84ee4f024bf0d458139a8142607960a0307feda205461c0e9f
SSDEEP

6144:b7VHzhC5EEKuBkFwbUDGTgtLA8n8tmiu7mxSeOnDvxDwOSa:9ThCTKuBtgD3BA0hLeONDFSa

Score

10^/10

GandCrab payload 3 IoCs

resource	yara_rule
behavioral2/memory/3524-1-0x0000000000400000-0x0000000000808000-memory.dmp	family_gandcrab
behavioral2/memory/3524-3-0x00000000009B0000-0x00000000009C6000-memory.dmp	family_gandcrab
behavioral2/memory/3524-6-0x0000000000400000-0x0000000000808000-memory.dmp	family_gandcrab

Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab

Detects Reflective DLL injection artifacts 3 IoCs

resource	yara_rule
behavioral2/memory/3524-1-0x0000000000400000-0x0000000000808000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/memory/3524-3-0x00000000009B0000-0x00000000009C6000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/memory/3524-6-0x0000000000400000-0x0000000000808000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects ransomware indicator 1 IoCs

resource	yara_rule
behavioral2/memory/3524-3-0x00000000009B0000-0x00000000009C6000-memory.dmp	SUSP_RANSOMWARE_Indicator_Jul20

Gandcrab Payload 3 IoCs

resource	yara_rule
behavioral2/memory/3524-1-0x0000000000400000-0x0000000000808000-memory.dmp	Gandcrab
behavioral2/memory/3524-3-0x00000000009B0000-0x00000000009C6000-memory.dmp	Gandcrab
behavioral2/memory/3524-6-0x0000000000400000-0x0000000000808000-memory.dmp	Gandcrab

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2036	3524	WerFault.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-02-12_6496653e6c982ee0b078565e27998335_karagany_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-12_6496653e6c982ee0b078565e27998335_karagany_mafia.exe"
1⤵
PID:3524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3524 -s 456
  2⤵
  - Program crash
  PID:2036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3524 -ip 3524
1⤵
PID:4968

memory/3524-2-0x0000000000B20000-0x0000000000C20000-memory.dmp

Filesize
1024KB

Download
memory/3524-1-0x0000000000400000-0x0000000000808000-memory.dmp

Filesize
4.0MB

Download
memory/3524-3-0x00000000009B0000-0x00000000009C6000-memory.dmp

Filesize
88KB

Download
memory/3524-6-0x0000000000400000-0x0000000000808000-memory.dmp

Filesize
4.0MB

Download