Analysis
-
max time kernel
90s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24/03/2024, 03:53
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe
-
Size
250KB
-
MD5
6e3db61be60dae16a438987f12cf3bd3
-
SHA1
593071595719f707c48cba94a26d9822425ce901
-
SHA256
a7ca1f11a197466e93d8de9a622f615410eb73d988284c09c5e44a0c1b2f6acd
-
SHA512
17fc5200480bd4226143069b9f7ae024a76bf49cd53cb22fa78deb579eefb34c78e3a94b8c46bf5dace984286dcd1556e9acc8896f60b9081f0b4ed3fce3f012
-
SSDEEP
6144:F+YrOIBjaklexBgiJ8sTSIkIpxIp8mDtfPBRwasxXq:FOCjaklYgVIpxIhDtR
Malware Config
Signatures
-
GandCrab payload 2 IoCs
resource yara_rule behavioral2/memory/2376-3-0x0000000000400000-0x0000000000444000-memory.dmp family_gandcrab behavioral2/memory/2376-4-0x00000000021D0000-0x00000000021E7000-memory.dmp family_gandcrab -
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Detects Reflective DLL injection artifacts 2 IoCs
resource yara_rule behavioral2/memory/2376-3-0x0000000000400000-0x0000000000444000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral2/memory/2376-4-0x00000000021D0000-0x00000000021E7000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader -
Detects ransomware indicator 2 IoCs
resource yara_rule behavioral2/memory/2376-3-0x0000000000400000-0x0000000000444000-memory.dmp SUSP_RANSOMWARE_Indicator_Jul20 behavioral2/memory/2376-4-0x00000000021D0000-0x00000000021E7000-memory.dmp SUSP_RANSOMWARE_Indicator_Jul20 -
Gandcrab Payload 2 IoCs
resource yara_rule behavioral2/memory/2376-3-0x0000000000400000-0x0000000000444000-memory.dmp Gandcrab behavioral2/memory/2376-4-0x00000000021D0000-0x00000000021E7000-memory.dmp Gandcrab -
Program crash 1 IoCs
pid pid_target Process procid_target 1812 2376 WerFault.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-24_6e3db61be60dae16a438987f12cf3bd3_karagany_mafia.exe"1⤵PID:2376
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 4762⤵
- Program crash
PID:1812
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2376 -ip 23761⤵PID:3672