Analysis
-
max time kernel
91s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
20-02-2024 06:10
General
-
Target
2024-02-20_ce6109e2422306308e287b957ae36984_karagany_mafia.exe
-
Size
250KB
-
MD5
ce6109e2422306308e287b957ae36984
-
SHA1
ffede5e5e1e504bbe9773a8814193939261c0c96
-
SHA256
aa3f1acb555d68be1c7ea3ba460f4e2e95fcf019cb8c0b49b9851b759554cae9
-
SHA512
abf8e8cf87dfe5b7cb67621efb0156ce19b0c5538cde390566de767228e5f011a7f83ff8128bd01abb0b686272aba986c63da14c016f9ed4c362d824ebc12aae
-
SSDEEP
6144:C+YrOIBjaklexBgiJ8sTSIkIpxIp8mDtfPBRwasxXq:eOCjaklYgVIpxIhDtR
Score
10/10
Malware Config
Signatures
-
GandCrab payload 2 IoCs
-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Detects Reflective DLL injection artifacts 2 IoCs
-
Detects ransomware indicator 2 IoCs
-
Gandcrab Payload 2 IoCs
-
Program crash 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-20_ce6109e2422306308e287b957ae36984_karagany_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-20_ce6109e2422306308e287b957ae36984_karagany_mafia.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 4722⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4936 -ip 49361⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
272KB
-
Filesize
272KB
-
Filesize
92KB
-
Filesize
108KB