Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
27/03/2024, 12:45
General
-
Target
2024-03-27_9497af7d0cc97717c5855957e8facd21_karagany_mafia.exe
-
Size
250KB
-
MD5
9497af7d0cc97717c5855957e8facd21
-
SHA1
e811a3832779bfb941cddb675f2ecc629920ad1a
-
SHA256
35e078103825d65b65d429656534ae33d42bac1f59523b0f49c31b383bc5a845
-
SHA512
a696b533edf01641326667ac1ff27ef8c4370d3953d342f67ef9aba696e23a74c71b24fbaae85cf0722967ae0aed219a3ab609d8ed6f9d58792cfa6b552238e3
-
SSDEEP
6144:3+YrOIBjaklexBgiJ8sTSIkIpxIp8mDtfPBRwasxXq:rOCjaklYgVIpxIhDtR
Score
10/10
Malware Config
Signatures
-
GandCrab payload 2 IoCs
-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Detects Reflective DLL injection artifacts 2 IoCs
-
Detects ransomware indicator 2 IoCs
-
Gandcrab Payload 2 IoCs
-
Program crash 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-27_9497af7d0cc97717c5855957e8facd21_karagany_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-27_9497af7d0cc97717c5855957e8facd21_karagany_mafia.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 4882⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1916 -ip 19161⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
272KB
-
Filesize
272KB
-
Filesize
92KB