Overview

overview

10

Static

static

3

9254e11419...33.exe

windows7-x64

10

9254e11419...33.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9254e114194c9d0bbe86800365ccec4bbac9c0004070951d4a2f145a04805033

  • Size

    223KB

  • Sample

    240425-aysfrscc78

  • MD5

    c0e39c032dc1669d9e26c49c6510b70d

  • SHA1

    4c3b01344c9810a1f795b250a15100271e5fb6bf

  • SHA256

    9254e114194c9d0bbe86800365ccec4bbac9c0004070951d4a2f145a04805033

  • SHA512

    fade36d0399c8dcc4319caab93a28182aede83598bb4e3f8e6b1e990f7f334983026260558d5368f65b8028642631084b6e7a162db4b8bf58405e5f321e3b59d

  • SSDEEP

    3072:x6X1UwEqwuZI4edpSIS+EhSDxbp4KxGAJovCle6zwLiXwdnQ4b5B12BSQpQ5L:x6XxXtSkKt2+e6zwLUAtBES5L

Score
10/10
gandcrabbackdoorpersistenceransomware

Malware Config

Targets

    • Target

      9254e114194c9d0bbe86800365ccec4bbac9c0004070951d4a2f145a04805033

    • Size

      223KB

    • MD5

      c0e39c032dc1669d9e26c49c6510b70d

    • SHA1

      4c3b01344c9810a1f795b250a15100271e5fb6bf

    • SHA256

      9254e114194c9d0bbe86800365ccec4bbac9c0004070951d4a2f145a04805033

    • SHA512

      fade36d0399c8dcc4319caab93a28182aede83598bb4e3f8e6b1e990f7f334983026260558d5368f65b8028642631084b6e7a162db4b8bf58405e5f321e3b59d

    • SSDEEP

      3072:x6X1UwEqwuZI4edpSIS+EhSDxbp4KxGAJovCle6zwLiXwdnQ4b5B12BSQpQ5L:x6XxXtSkKt2+e6zwLUAtBES5L

    Score
    10/10
    gandcrabbackdoorpersistenceransomware

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • Detects Reflective DLL injection artifacts

    • Detects ransomware indicator

    • Gandcrab Payload

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks