Static task
static1
Behavioral task
behavioral1
Sample
2024-04-01_8c3247b739b838550a561dfa1d91477e_gandcrab_karagany.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-01_8c3247b739b838550a561dfa1d91477e_gandcrab_karagany.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-01_8c3247b739b838550a561dfa1d91477e_gandcrab_karagany
-
Size
177KB
-
MD5
8c3247b739b838550a561dfa1d91477e
-
SHA1
2b87d85607d5095d45123382ea32d37e44f32e77
-
SHA256
98c85c3b6457bb797d1994d116b5fd8a098e33c51cbb960ae8de5efe7fa49cc8
-
SHA512
223a1e5be82f4852a4622b168e6b2a473259e98662a2d6e9454ab302eb0f9df026734f8af4d3377d3630283613980beae788d55b8bcd9aec779fce4425677eca
-
SSDEEP
3072:MxgidvBOyONJMjNP9Fgz/z98PtM7JARKcFw40kio4eY+ykU02dbt9i+lAbHVzgWa:Mui/OyONWjvBP1RKheUkU02746Ab1zgz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2024-04-01_8c3247b739b838550a561dfa1d91477e_gandcrab_karagany
Files
-
2024-04-01_8c3247b739b838550a561dfa1d91477e_gandcrab_karagany.exe windows:5 windows x86 arch:x86
eab30870a6e1236da19419cc3f5cb6ca
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTapeStatus
FreeUserPhysicalPages
FindAtomA
SetLocaleInfoW
EraseTape
VirtualProtect
Module32NextW
TlsAlloc
GetConsoleSelectionInfo
CloseHandle
CreateFileW
GetProcAddress
FlushFileBuffers
HeapReAlloc
HeapAlloc
GetStringTypeW
LCMapStringW
IsProcessorFeaturePresent
WriteConsoleW
SetStdHandle
RtlUnwind
MultiByteToWideChar
Sleep
SetThreadPriority
LoadLibraryW
GetPrivateProfileIntA
SetCommBreak
CreateJobObjectW
GetCPInfo
GetStringTypeA
lstrlenA
HeapSize
FileTimeToDosDateTime
HeapFree
IsValidCodePage
GetOEMCP
GetACP
GetCommandLineW
HeapSetInformation
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
DecodePointer
TerminateProcess
GetCurrentProcess
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
user32
SetWindowContextHelpId
ToAsciiEx
EnumPropsW
GetKeyNameTextA
ReplyMessage
CreateDesktopA
DlgDirSelectExA
WindowFromPoint
DrawEdge
GetClassLongA
DrawFocusRect
GetUpdateRect
GetWindowPlacement
CreateWindowExA
GetWindowContextHelpId
GetActiveWindow
EqualRect
SystemParametersInfoA
SetWindowTextA
GetMonitorInfoW
ActivateKeyboardLayout
gdi32
SetMetaFileBitsEx
CreateColorSpaceA
RectInRegion
GdiSetBatchLimit
GetMapMode
CreateFontIndirectExW
GetTextAlign
GetTextExtentExPointA
GetTextMetricsW
winspool.drv
DeviceCapabilitiesA
msimg32
TransparentBlt
Sections
.text Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 652KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 107KB - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ