Analysis

  • max time kernel
    92s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/03/2024, 06:53

General

  • Target

    2024-03-24_c756b90970f231030ab472cbcfda9f8e_karagany_mafia.exe

  • Size

    308KB

  • MD5

    c756b90970f231030ab472cbcfda9f8e

  • SHA1

    f76bcd88fbed5a4df1d71837a76d5a29dbae6a36

  • SHA256

    9a8ea618acca15905ea1295783f846d54f0856176fce6c55fa0866c3558ceecf

  • SHA512

    8b6b24b69e32106a0ca63df4f09f81d4ec9a55070e5d01ac48c64245ae6463f9e1481938981aa070b6c1725f4f19a8ccfd514aca0b6c007b7747a7f296cec38a

  • SSDEEP

    6144:+EL7ShWDhbzVNam6GxI29dqG3KdYAYqTuPZu:nDrNam62ZdKmZmuPY

Malware Config

Signatures

  • GandCrab payload 2 IoCs
  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

  • Detects Reflective DLL injection artifacts 2 IoCs
  • Detects ransomware indicator 1 IoCs
  • Gandcrab Payload 2 IoCs
  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-24_c756b90970f231030ab472cbcfda9f8e_karagany_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-24_c756b90970f231030ab472cbcfda9f8e_karagany_mafia.exe"
    1⤵
      PID:1680
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 472
        2⤵
        • Program crash
        PID:244
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1680 -ip 1680
      1⤵
        PID:1936

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/1680-1-0x000000000AA70000-0x000000000AB70000-memory.dmp

              Filesize

              1024KB

            • memory/1680-2-0x0000000000400000-0x0000000001400000-memory.dmp

              Filesize

              16.0MB

            • memory/1680-3-0x000000000C720000-0x000000000C737000-memory.dmp

              Filesize

              92KB