gandcrab | a31086f9da3a63675bb25651d6eba4bd22f07050994bc40fdd6a319b8983262d

Analysis

max time kernel
144s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 19:03

Target

2024-03-07_f14510f68e32da07424a011962827a15_karagany_mafia.exe
Size

308KB
MD5

f14510f68e32da07424a011962827a15
SHA1

54e50ead3f740e14dd051f2455751eaf24500f35
SHA256

a31086f9da3a63675bb25651d6eba4bd22f07050994bc40fdd6a319b8983262d
SHA512

fd5d1bc73ca642693ab779adff694f64cd4dd6650a21a1254da0e6ae6df50f305120a0754a57d70cd17f198fe6c3e4118a618db1771f2816698f9ded50deab6c
SSDEEP

6144:tzL7ShWDLVzVNam6GxI29dqG3KdYAYqTuPZp:jDHNam62ZdKmZmuPH

Score

10^/10

GandCrab payload 2 IoCs

resource	yara_rule
behavioral2/memory/3908-2-0x0000000000400000-0x0000000001400000-memory.dmp	family_gandcrab
behavioral2/memory/3908-3-0x000000000ABA0000-0x000000000ABB7000-memory.dmp	family_gandcrab

Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab

Detects Reflective DLL injection artifacts 2 IoCs

resource	yara_rule
behavioral2/memory/3908-2-0x0000000000400000-0x0000000001400000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/memory/3908-3-0x000000000ABA0000-0x000000000ABB7000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects ransomware indicator 1 IoCs

resource	yara_rule
behavioral2/memory/3908-3-0x000000000ABA0000-0x000000000ABB7000-memory.dmp	SUSP_RANSOMWARE_Indicator_Jul20

Gandcrab Payload 2 IoCs

resource	yara_rule
behavioral2/memory/3908-2-0x0000000000400000-0x0000000001400000-memory.dmp	Gandcrab
behavioral2/memory/3908-3-0x000000000ABA0000-0x000000000ABB7000-memory.dmp	Gandcrab

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4376	3908	WerFault.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-03-07_f14510f68e32da07424a011962827a15_karagany_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-07_f14510f68e32da07424a011962827a15_karagany_mafia.exe"
1⤵
PID:3908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 480
  2⤵
  - Program crash
  PID:4376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3908 -ip 3908
1⤵
PID:4756

memory/3908-1-0x000000000ABC0000-0x000000000ACC0000-memory.dmp

Filesize
1024KB

Download
memory/3908-2-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/3908-3-0x000000000ABA0000-0x000000000ABB7000-memory.dmp

Filesize
92KB

Download