gandcrab | 51eb75d20e02d8109bd0a77f1ff572a486274876d4fa0fa211354a8f6aa43bca | Triage

Analysis

max time kernel
94s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23/02/2024, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

106df363a6782a0ec25ba566adbcf144.exe
Size

308KB
MD5

106df363a6782a0ec25ba566adbcf144
SHA1

3d0ee3622202936614a9da34cff277b3b44ebda5
SHA256

51eb75d20e02d8109bd0a77f1ff572a486274876d4fa0fa211354a8f6aa43bca
SHA512

01b84bb184062f0649cbc719de4f57903021aed01aebd9d35fc8b09260b00e2e3d665878180db9565d83d5b97e47175701b57b80aca1a1cb08fd4dc8ac48e3f5
SSDEEP

6144:WzL7ShWDLVzVNam6GxI29dqG3KdYAYqTuPZp:UDHNam62ZdKmZmuPH

Score

10^/10

gandcrab backdoor ransomware

Malware Config

Signatures

GandCrab payload 2 IoCs

resource	yara_rule
behavioral2/memory/3480-2-0x0000000000400000-0x0000000001400000-memory.dmp	family_gandcrab
behavioral2/memory/3480-3-0x000000000C5F0000-0x000000000C607000-memory.dmp	family_gandcrab

Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5020	3480	WerFault.exe	39

C:\Users\Admin\AppData\Local\Temp\106df363a6782a0ec25ba566adbcf144.exe
"C:\Users\Admin\AppData\Local\Temp\106df363a6782a0ec25ba566adbcf144.exe"
1⤵
PID:3480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 484
  2⤵
  - Program crash
  PID:5020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3480 -ip 3480
1⤵
PID:3760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3480-1-0x000000000AB00000-0x000000000AC00000-memory.dmp

Filesize
1024KB

Download
memory/3480-2-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/3480-3-0x000000000C5F0000-0x000000000C607000-memory.dmp

Filesize
92KB

Download