Analysis
- max time kernel
94s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
28/03/2024, 02:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe
Resource
win7-20240220-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe
- Size 300KB
- Sample240328-c46axsdc7w
- SHA256 50573540aa3007d66973df4931d071725048170c97382acea40933d197d853eb
- MD5 54a5a9ea41d3c253bd679f5146b0d2b1
- SHA1 3601bbdab82976e4128c810fe7a3b3e1d28fe279
- SHA512 b013f7348ff573d790f3776df0e3960ccd14a1a53fa48b8c9c6ceb0be0e2a9d5dd1de4392abde42316ee38c8cdddd2b86d0852e4712dbfd01d886bc21c47c0e7
- SSDEEP 6144:vvEANMO1UnseVgkV0xwvfxnhLTiusLe1740B:kuM0Unsna5mut40B
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- GandCrab payload 2 IoCs
resource yara_rule behavioral2/memory/4760-1-0x0000000000400000-0x0000000003B9B000-memory.dmp family_gandcrab behavioral2/memory/4760-2-0x0000000005990000-0x00000000059A7000-memory.dmp family_gandcrab - Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
- Detects Reflective DLL injection artifacts 2 IoCs
resource yara_rule behavioral2/memory/4760-1-0x0000000000400000-0x0000000003B9B000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral2/memory/4760-2-0x0000000005990000-0x00000000059A7000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader - Detects ransomware indicator 1 IoCs
resource yara_rule behavioral2/memory/4760-2-0x0000000005990000-0x00000000059A7000-memory.dmp SUSP_RANSOMWARE_Indicator_Jul20 - Gandcrab Payload 2 IoCs
resource yara_rule behavioral2/memory/4760-1-0x0000000000400000-0x0000000003B9B000-memory.dmp Gandcrab behavioral2/memory/4760-2-0x0000000005990000-0x00000000059A7000-memory.dmp Gandcrab - Program crash 1 IoCs
pid pid_target Process procid_target 3180 4760 WerFault.exe 85 - Suspicious use of SetWindowsHookAW 64 IoCs
pid Process 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe 4760 2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-28_54a5a9ea41d3c253bd679f5146b0d2b1_mafia.exe"1⤵
- Suspicious use of SetWindowsHookAW
PID:4760 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 4802⤵
- Program crash
PID:3180
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4760 -ip 47601⤵PID:1148