Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    26-04-2024 14:44

General

  • Target

    2024-04-26_14227f64edcb3b5c7cb8f85332521778_mafia.exe

  • Size

    316KB

  • MD5

    14227f64edcb3b5c7cb8f85332521778

  • SHA1

    19a79540190d8287ba58c6d539e0d5c87875deea

  • SHA256

    ea105dae9196b2abb2d63df2c9a44b65c101737be0be3e2e2ce1da0a0eab8ee4

  • SHA512

    bf15cd4bd58a86d44c556666a3073b8a6c86d87b6488957eb9c9f8515d1294a674d4466723f40d34d76cc34ea1919fc0a56d811be9d3af174f849ffada64be26

  • SSDEEP

    6144:rv+3NMO1UnseVgkV0xwvfxnhLTiusLe1740Y:adM0Unsna5mut40Y

Malware Config

Signatures

  • GandCrab payload 3 IoCs
  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

  • Detects Reflective DLL injection artifacts 3 IoCs
  • Detects ransomware indicator 1 IoCs
  • Gandcrab Payload 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookAW 64 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-26_14227f64edcb3b5c7cb8f85332521778_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-26_14227f64edcb3b5c7cb8f85332521778_mafia.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookAW
    • Suspicious use of WriteProcessMemory
    PID:2440
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      2⤵
        PID:1964
      • C:\Windows\SysWOW64\nslookup.exe
        nslookup ransomware.bit ns2.wowservers.ru
        2⤵
          PID:2692
        • C:\Windows\SysWOW64\nslookup.exe
          nslookup carder.bit ns2.wowservers.ru
          2⤵
            PID:2344
          • C:\Windows\SysWOW64\nslookup.exe
            nslookup ransomware.bit ns1.wowservers.ru
            2⤵
              PID:1628
            • C:\Windows\SysWOW64\nslookup.exe
              nslookup carder.bit ns1.wowservers.ru
              2⤵
                PID:3016
              • C:\Windows\SysWOW64\nslookup.exe
                nslookup ransomware.bit ns2.wowservers.ru
                2⤵
                  PID:2496

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/2440-0-0x0000000000400000-0x0000000003B9F000-memory.dmp

                Filesize

                55.6MB

              • memory/2440-1-0x00000000001B0000-0x00000000001CB000-memory.dmp

                Filesize

                108KB

              • memory/2440-3-0x0000000000270000-0x0000000000287000-memory.dmp

                Filesize

                92KB

              • memory/2440-2-0x0000000000400000-0x0000000003B9F000-memory.dmp

                Filesize

                55.6MB

              • memory/2440-10-0x0000000000400000-0x0000000003B9F000-memory.dmp

                Filesize

                55.6MB