Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/03/2024, 04:16

General

  • Target

    2024-03-24_c6e9b6673092f1b0052de113fc7779bb_karagany_mafia.exe

  • Size

    250KB

  • MD5

    c6e9b6673092f1b0052de113fc7779bb

  • SHA1

    89d7fa534512e87324fe97fa8f52399430098e86

  • SHA256

    c3c136b14005f948e6e0c8b011a2f5b1a417a28e7966a74795d2b885e08947c8

  • SHA512

    15724ef7031182e742ca6f1dff0036651bcdee5f7ee429634c29d47a1155f398629636f5f5b557def02aceef1f4acce34c3ccb3c133fc02ec500427225427795

  • SSDEEP

    3072:Y/yK5d0Gj0+nY3uEBLvBNfdUR2/qFnB8o2+vU3WuvIBuj00nReaXkuSQ7cdOd3:Y/y20Gj0r+EBFrkvlU3RvIUDOIN

Malware Config

Signatures

  • GandCrab payload 2 IoCs
  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

  • Detects Reflective DLL injection artifacts 2 IoCs
  • Detects ransomware indicator 2 IoCs
  • Gandcrab Payload 2 IoCs
  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-24_c6e9b6673092f1b0052de113fc7779bb_karagany_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-24_c6e9b6673092f1b0052de113fc7779bb_karagany_mafia.exe"
    1⤵
      PID:4412
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 440
        2⤵
        • Program crash
        PID:3012
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4412 -ip 4412
      1⤵
        PID:4512

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/4412-2-0x00000000006C0000-0x00000000007C0000-memory.dmp

              Filesize

              1024KB

            • memory/4412-3-0x0000000000400000-0x0000000000444000-memory.dmp

              Filesize

              272KB

            • memory/4412-4-0x0000000000400000-0x0000000000444000-memory.dmp

              Filesize

              272KB

            • memory/4412-6-0x0000000002190000-0x00000000021A7000-memory.dmp

              Filesize

              92KB