gandcrab | 271d76be85fb89564c007e3ba7c5dcd60afe8f46bb3944f2a3c413a146dbb4c4

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2024 20:02

Target

2024-03-28_a56dd4454108cefb6a11190936f2e707_karagany_mafia.exe
Size

308KB
MD5

a56dd4454108cefb6a11190936f2e707
SHA1

306e2b0a91fd7feec56ed8e257a2653f4644a675
SHA256

271d76be85fb89564c007e3ba7c5dcd60afe8f46bb3944f2a3c413a146dbb4c4
SHA512

18defbb3896b000547e28ff50aff57bae6ec2d44979a58ac6ac796a011b1d82c42848a3cd2c4fd52e705b9b0d628fb3960a6852e076aed4083eb6b86710b3dca
SSDEEP

6144:jzL7ShWDLVzVNam6GxI29dqG3KdYAYqTuPZp:xDHNam62ZdKmZmuPH

Score

10^/10

GandCrab payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4948-2-0x0000000000400000-0x0000000001400000-memory.dmp	family_gandcrab
behavioral2/memory/4948-3-0x000000000AC40000-0x000000000AC57000-memory.dmp	family_gandcrab

Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab

Detects Reflective DLL injection artifacts 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4948-2-0x0000000000400000-0x0000000001400000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/memory/4948-3-0x000000000AC40000-0x000000000AC57000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects ransomware indicator 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4948-3-0x000000000AC40000-0x000000000AC57000-memory.dmp	SUSP_RANSOMWARE_Indicator_Jul20

Gandcrab Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4948-2-0x0000000000400000-0x0000000001400000-memory.dmp	Gandcrab
behavioral2/memory/4948-3-0x000000000AC40000-0x000000000AC57000-memory.dmp	Gandcrab

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4884 4948 WerFault.exe 2024-03-28_a56dd4454108cefb6a11190936f2e707_karagany_mafia.exe

pid	pid_target	process	target process
4884	4948	WerFault.exe	2024-03-28_a56dd4454108cefb6a11190936f2e707_karagany_mafia.exe

C:\Users\Admin\AppData\Local\Temp\2024-03-28_a56dd4454108cefb6a11190936f2e707_karagany_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-28_a56dd4454108cefb6a11190936f2e707_karagany_mafia.exe"
1⤵
PID:4948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 480
2⤵
- Program crash
PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4948 -ip 4948
1⤵
PID:3076

memory/4948-1-0x000000000ACF0000-0x000000000ADF0000-memory.dmp

Filesize
1024KB

Download
memory/4948-2-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/4948-3-0x000000000AC40000-0x000000000AC57000-memory.dmp

Filesize
92KB

Download