Analysis

  • max time kernel
    90s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/03/2024, 03:53

General

  • Target

    2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe

  • Size

    250KB

  • MD5

    6e3db61be60dae16a438987f12cf3bd3

  • SHA1

    593071595719f707c48cba94a26d9822425ce901

  • SHA256

    a7ca1f11a197466e93d8de9a622f615410eb73d988284c09c5e44a0c1b2f6acd

  • SHA512

    17fc5200480bd4226143069b9f7ae024a76bf49cd53cb22fa78deb579eefb34c78e3a94b8c46bf5dace984286dcd1556e9acc8896f60b9081f0b4ed3fce3f012

  • SSDEEP

    6144:F+YrOIBjaklexBgiJ8sTSIkIpxIp8mDtfPBRwasxXq:FOCjaklYgVIpxIhDtR

Malware Config

Signatures

  • GandCrab payload 2 IoCs
  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

  • Detects Reflective DLL injection artifacts 2 IoCs
  • Detects ransomware indicator 2 IoCs
  • Gandcrab Payload 2 IoCs
  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe"
    1⤵
      PID:2376
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 476
        2⤵
        • Program crash
        PID:1812
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2376 -ip 2376
      1⤵
        PID:3672

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/2376-0-0x00000000021A0000-0x00000000021BB000-memory.dmp

              Filesize

              108KB

            • memory/2376-1-0x00000000021A0000-0x00000000021BB000-memory.dmp

              Filesize

              108KB

            • memory/2376-2-0x0000000000400000-0x0000000000444000-memory.dmp

              Filesize

              272KB

            • memory/2376-3-0x0000000000400000-0x0000000000444000-memory.dmp

              Filesize

              272KB

            • memory/2376-4-0x00000000021D0000-0x00000000021E7000-memory.dmp

              Filesize

              92KB