gandcrab | 54edb8e84b1d573e68bbb07dae36fefe7e2bbbac962cdd9f24f66eec7635215a

Analysis

max time kernel
93s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/03/2024, 10:24

Target
2024-03-03_08c6339b62de4d34a12b989013e04a14_karagany_mafia_magniber.exe
Size 308KB
Sample240303-mfpy5shb2t
SHA256 54edb8e84b1d573e68bbb07dae36fefe7e2bbbac962cdd9f24f66eec7635215a
MD5 08c6339b62de4d34a12b989013e04a14
SHA1 f1e3669a51d5693807b538195c60714995579915
SHA512 769e94ef589c5380a9ca438aecd3bc23bc4ff5550754f0c497dbd345b34e98697a6e0134e180da302b9eed50380b18b590ba09721a322a4a50e4a7ea5b1e70ef
SSDEEP 3072:tmBr3balBclw29DXaPB2J9ot3nPIGX30caGhDgGCcc4Go0ER5IY0ms41:tmBrrDDX0tXT30vzHF4Go0+Fs41
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

GandCrab payload 2 IoCs

resource	yara_rule
behavioral2/memory/2664-1-0x0000000000400000-0x0000000000E86000-memory.dmp	family_gandcrab
behavioral2/memory/2664-4-0x0000000001110000-0x0000000001126000-memory.dmp	family_gandcrab

Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab

Detects Reflective DLL injection artifacts 2 IoCs

resource	yara_rule
behavioral2/memory/2664-1-0x0000000000400000-0x0000000000E86000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/memory/2664-4-0x0000000001110000-0x0000000001126000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects ransomware indicator 1 IoCs

resource	yara_rule
behavioral2/memory/2664-4-0x0000000001110000-0x0000000001126000-memory.dmp	SUSP_RANSOMWARE_Indicator_Jul20

Gandcrab Payload 2 IoCs

resource	yara_rule
behavioral2/memory/2664-1-0x0000000000400000-0x0000000000E86000-memory.dmp	Gandcrab
behavioral2/memory/2664-4-0x0000000001110000-0x0000000001126000-memory.dmp	Gandcrab

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5112	2664	WerFault.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-03-03_08c6339b62de4d34a12b989013e04a14_karagany_mafia_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-03_08c6339b62de4d34a12b989013e04a14_karagany_mafia_magniber.exe"
1⤵
PID:2664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 372
  2⤵
  - Program crash
  PID:5112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2664 -ip 2664
1⤵
PID:4424

memory/2664-1-0x0000000000400000-0x0000000000E86000-memory.dmp

Download

memory/2664-2-0x0000000001140000-0x0000000001240000-memory.dmp

Download

memory/2664-4-0x0000000001110000-0x0000000001126000-memory.dmp

Download