Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
21/02/2024, 21:41
General
-
Target
2024-02-21_e846bbd989a2cfb695155f9bb18f97f6_karagany_mafia.exe
-
Size
250KB
-
MD5
e846bbd989a2cfb695155f9bb18f97f6
-
SHA1
557b45658e87dc78959091fcf76d3520b206c19e
-
SHA256
1b8e78b2bf9e1ffb8f41aafa59d24cb5b3ab84b583ae4a6039241a150921b5dc
-
SHA512
0899de7240014e4f103a36f5249c6779004e94853a9606dbcda5bab0c87a29bf1a15350120c642628dc8eb9c64335ce48ba357f55d16d7ff5bdd82e103d7d5cb
-
SSDEEP
6144:P+YrOIBjaklexBgiJ8sTSIkIpxIp8mDtfPBRwasxXq:DOCjaklYgVIpxIhDtR
Score
10/10
Malware Config
Signatures
-
GandCrab payload 2 IoCs
-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Detects Reflective DLL injection artifacts 2 IoCs
-
Detects ransomware indicator 2 IoCs
-
Gandcrab Payload 2 IoCs
-
Program crash 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-21_e846bbd989a2cfb695155f9bb18f97f6_karagany_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-21_e846bbd989a2cfb695155f9bb18f97f6_karagany_mafia.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 4642⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 2296 -ip 22961⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
272KB
-
Filesize
272KB
-
Filesize
92KB
-
Filesize
108KB