Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
12/03/2024, 08:25
General
-
Target
2024-03-12_330771ca2d984dcdd9b8b243373a3fdb_karagany_mafia.exe
-
Size
250KB
-
MD5
330771ca2d984dcdd9b8b243373a3fdb
-
SHA1
7fca2f694e51f85a20a7e5c9b1c640238c72d757
-
SHA256
91ec33667f48a90285854fdcc0fd75365e95bcfbbad9aef82344f52177acba74
-
SHA512
6c7c6da8b7bcffec7e9dd6ba1943f40ee0686ef6df8c9f81692d008d584481b69386f0ba561faa39df2fb8b6f4e34442e6e4bc3ccb88926a4297eac394d7509f
-
SSDEEP
6144:++YrOIBjaklexBgiJ8sTSIkIpxIp8mDtfPBRwasxXq:qOCjaklYgVIpxIhDtR
Score
10/10
Malware Config
Signatures
-
GandCrab payload 2 IoCs
-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Detects Reflective DLL injection artifacts 2 IoCs
-
Detects ransomware indicator 2 IoCs
-
Gandcrab Payload 2 IoCs
-
Program crash 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-12_330771ca2d984dcdd9b8b243373a3fdb_karagany_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-12_330771ca2d984dcdd9b8b243373a3fdb_karagany_mafia.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 4722⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2184 -ip 21841⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
272KB
-
Filesize
272KB
-
Filesize
92KB