Analysis
- max time kernel
148s - max time network
152s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
24/03/2024, 03:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe
- Size 250KB
- Sample240324-ef13eaca8s
- SHA256 a7ca1f11a197466e93d8de9a622f615410eb73d988284c09c5e44a0c1b2f6acd
- MD5 6e3db61be60dae16a438987f12cf3bd3
- SHA1 593071595719f707c48cba94a26d9822425ce901
- SHA512 17fc5200480bd4226143069b9f7ae024a76bf49cd53cb22fa78deb579eefb34c78e3a94b8c46bf5dace984286dcd1556e9acc8896f60b9081f0b4ed3fce3f012
- SSDEEP 6144:F+YrOIBjaklexBgiJ8sTSIkIpxIp8mDtfPBRwasxXq:FOCjaklYgVIpxIhDtR
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- GandCrab payload 4 IoCs
resource yara_rule behavioral1/memory/1988-3-0x0000000000400000-0x0000000000444000-memory.dmp family_gandcrab behavioral1/memory/1988-4-0x0000000000450000-0x0000000000467000-memory.dmp family_gandcrab behavioral1/memory/1988-11-0x0000000000400000-0x0000000000444000-memory.dmp family_gandcrab behavioral1/memory/1988-14-0x0000000000450000-0x0000000000467000-memory.dmp family_gandcrab - Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
- Detects Reflective DLL injection artifacts 4 IoCs
resource yara_rule behavioral1/memory/1988-3-0x0000000000400000-0x0000000000444000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral1/memory/1988-4-0x0000000000450000-0x0000000000467000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral1/memory/1988-11-0x0000000000400000-0x0000000000444000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral1/memory/1988-14-0x0000000000450000-0x0000000000467000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader - Detects ransomware indicator 4 IoCs
resource yara_rule behavioral1/memory/1988-3-0x0000000000400000-0x0000000000444000-memory.dmp SUSP_RANSOMWARE_Indicator_Jul20 behavioral1/memory/1988-4-0x0000000000450000-0x0000000000467000-memory.dmp SUSP_RANSOMWARE_Indicator_Jul20 behavioral1/memory/1988-11-0x0000000000400000-0x0000000000444000-memory.dmp SUSP_RANSOMWARE_Indicator_Jul20 behavioral1/memory/1988-14-0x0000000000450000-0x0000000000467000-memory.dmp SUSP_RANSOMWARE_Indicator_Jul20 - Gandcrab Payload 4 IoCs
resource yara_rule behavioral1/memory/1988-3-0x0000000000400000-0x0000000000444000-memory.dmp Gandcrab behavioral1/memory/1988-4-0x0000000000450000-0x0000000000467000-memory.dmp Gandcrab behavioral1/memory/1988-11-0x0000000000400000-0x0000000000444000-memory.dmp Gandcrab behavioral1/memory/1988-14-0x0000000000450000-0x0000000000467000-memory.dmp Gandcrab - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vtzdrrezqdz = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\jpteez.exe\"" 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe File opened (read-only) \??\Q: 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe File opened (read-only) \??\T: 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe File opened (read-only) \??\H: 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe File opened (read-only) \??\G: 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe File opened (read-only) \??\K: 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe File opened (read-only) \??\N: 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe File opened (read-only) \??\P: 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe File opened (read-only) \??\U: 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe File opened (read-only) \??\X: 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe File opened (read-only) \??\Y: 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe File opened (read-only) \??\A: 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe File opened (read-only) \??\Z: 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe File opened (read-only) \??\B: 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe File opened (read-only) \??\I: 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe File opened (read-only) \??\J: 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe File opened (read-only) \??\M: 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe File opened (read-only) \??\O: 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe File opened (read-only) \??\R: 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe File opened (read-only) \??\S: 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe File opened (read-only) \??\V: 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe File opened (read-only) \??\E: 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe File opened (read-only) \??\W: 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1988 wrote to memory of 2972 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 28 PID 1988 wrote to memory of 2972 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 28 PID 1988 wrote to memory of 2972 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 28 PID 1988 wrote to memory of 2972 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 28 PID 1988 wrote to memory of 2772 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 30 PID 1988 wrote to memory of 2772 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 30 PID 1988 wrote to memory of 2772 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 30 PID 1988 wrote to memory of 2772 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 30 PID 1988 wrote to memory of 2560 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 32 PID 1988 wrote to memory of 2560 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 32 PID 1988 wrote to memory of 2560 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 32 PID 1988 wrote to memory of 2560 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 32 PID 1988 wrote to memory of 2724 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 34 PID 1988 wrote to memory of 2724 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 34 PID 1988 wrote to memory of 2724 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 34 PID 1988 wrote to memory of 2724 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 34 PID 1988 wrote to memory of 2440 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 36 PID 1988 wrote to memory of 2440 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 36 PID 1988 wrote to memory of 2440 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 36 PID 1988 wrote to memory of 2440 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 36 PID 1988 wrote to memory of 1348 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 38 PID 1988 wrote to memory of 1348 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 38 PID 1988 wrote to memory of 1348 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 38 PID 1988 wrote to memory of 1348 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 38 PID 1988 wrote to memory of 2252 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 42 PID 1988 wrote to memory of 2252 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 42 PID 1988 wrote to memory of 2252 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 42 PID 1988 wrote to memory of 2252 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 42 PID 1988 wrote to memory of 1688 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 44 PID 1988 wrote to memory of 1688 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 44 PID 1988 wrote to memory of 1688 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 44 PID 1988 wrote to memory of 1688 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 44 PID 1988 wrote to memory of 1984 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 46 PID 1988 wrote to memory of 1984 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 46 PID 1988 wrote to memory of 1984 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 46 PID 1988 wrote to memory of 1984 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 46 PID 1988 wrote to memory of 872 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 48 PID 1988 wrote to memory of 872 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 48 PID 1988 wrote to memory of 872 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 48 PID 1988 wrote to memory of 872 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 48 PID 1988 wrote to memory of 532 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 50 PID 1988 wrote to memory of 532 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 50 PID 1988 wrote to memory of 532 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 50 PID 1988 wrote to memory of 532 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 50 PID 1988 wrote to memory of 1352 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 52 PID 1988 wrote to memory of 1352 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 52 PID 1988 wrote to memory of 1352 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 52 PID 1988 wrote to memory of 1352 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 52 PID 1988 wrote to memory of 1292 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 54 PID 1988 wrote to memory of 1292 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 54 PID 1988 wrote to memory of 1292 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 54 PID 1988 wrote to memory of 1292 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 54 PID 1988 wrote to memory of 2728 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 56 PID 1988 wrote to memory of 2728 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 56 PID 1988 wrote to memory of 2728 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 56 PID 1988 wrote to memory of 2728 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 56 PID 1988 wrote to memory of 1532 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 58 PID 1988 wrote to memory of 1532 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 58 PID 1988 wrote to memory of 1532 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 58 PID 1988 wrote to memory of 1532 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 58 PID 1988 wrote to memory of 2284 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 60 PID 1988 wrote to memory of 2284 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 60 PID 1988 wrote to memory of 2284 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 60 PID 1988 wrote to memory of 2284 1988 2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe 60
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2972
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2772
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2560
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2724
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2440
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:1348
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2252
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1688
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1984
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:872
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:532
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1352
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1292
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2728
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1532
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2284
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1540
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:1764
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:308
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1372
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1420
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:976
-