Overview

overview

10

Static

static

3

SecuriteIn...95.exe

windows7-x64

10

SecuriteIn...95.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-04-2024 15:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Trojan.Encoder.28247.1335.4895.exe

  • Size

    291KB

  • MD5

    e6b43b1028b6000009253344632e69c4

  • SHA1

    e536b70e3ffe309f7ae59918da471d7bf4cadd1c

  • SHA256

    bfb9db791b8250ffa8ebc48295c5dbbca757a5ed3bbb01de12a871b5cd9afd5a

  • SHA512

    07da214314673407a7d3978ee6e1d20bf1e02f135bf557e86b50489ecc146014f2534515c1b613dba96e65489d8c82caaa8ed2e647684d61e5e86bd3e8251adf

  • SSDEEP

    6144:nSRCSpUtLz+/enihebWBUOP3yIhLVMmi0CtG7go+I:SUOEnNnHbmP3yIE3tGX

Score
10/10
gandcrabbackdoorransomwarespywarestealer

Malware Config

Extracted

Path

F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\QGVSNMWIC-MANUAL.txt

Family

gandcrab

Ransom Note
---= GANDCRAB V5.2 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .QGVSNMWIC The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/3fbe73a8120b0f25 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAOzOAN2ifdRpZK9GZA9ZRRLEqUnk7QKgNtTO1bcOK+zvXejDvOSMlu1R+S8eciFYmn2hhq7lxq3b+dABz5h4Y6LmeMq+7ed1qpnnYPoGv/+F9jiFu03pUBhRNaI5ZwbZbPt1XBk2TcIMWPTovd+eOYNBWnQQfmgpkWrkLktm1x2+rTZE5b8aXj088K+024d7850QYxuwBN8vuIx1OXZqogqxlB2N377DrrbmSN819X1QMU8nGSEWV87r+wA+cKl/FFLNLb/NuINyALHe4ta1S314QKLlGOOJCz1q4O+CqMmG6gbuJPXLhuVybwlngPl8pYKAudVE5oqXIcVH2LNWWRPxwWy67QTYmJy8zlFIhtBrJFcCZ3bts/8kePSK77lpltNeYEZhyCDNbiWOds21P0KQo/gELwG7TVEGTiPGSSQcNRR0sgkQgMF5TC54fERgkj/b0cbB+tKNDRkE2tqzn2pnEwS/ku3eR0qbxy9KdRiwV4NM2FJfRsSidYUzMEnBfmFPtrgY9klYdXjp0MoVPTgjfwSsyiHukYQqjVf4wAyV+qyJTx0YIMtkldh6wCPgpEamMjTbqipN4MslNs7BSwSPsr/P3uWDfBmop/F6X8wyur95m26RhiLFodJL0ssFoQzWXuiCH2t2YHZelQebN1BupJo3Ue7lYh4Le+O0fM2nPGHoSIMh1SSejwnrqCcmOcFXcN7TmUFri6cLmt5atQtvV04CJEwYVtEMG1tKMGDAQcOTRUhS/EO1CaMTOK5cy6NH7rrZtgjZgRvmfkQL8fkYoblVNM+mP8omJowWXIQKfk5pBxZ90Qzr2Xw7Dx6OgJ3rAIv4K6pqv7M9d5H6ducrFG4/vTe7P+1YEVt3ZijDJ5P7OujHawKApYaPHP7Ah1ORBL1tH0ezgDPBpB19C5R+WQEjym2fAdF0n2lg9ca01JwFn3V91lFghoQAIeg8buFo09mVZiB1P1AHG8YEurxtn1LCeg5NtnoeSSwB93Fpb1YI9PdOYVgVg9/BcAAqxe1TQVL9dQmjukHMNHasZvE4WGSwpsM2yhgCCkWDQCAxaTrOQWX8ZiqlBDLqyNLOUMWNQnHReXqQebRDlqXaKtAXkm0NlyxlIvk8tdwNBQNs4xPNquSOlPJk9ADlx+hGf/Uvo0cVVt/djNX9I4xx73wlVatUCMWqaG5uZJYM2SzFDw0ANVtiegnY6Dxwzjm+fTVtiGZaouKI37s9iiyNzFV977/jNcYegKzupGJLhFOVRujVvupurHsYw30AUOdYPkgknel2ppnQIt8JgoCMV0AAp1Uo88PJv5IwepTBXwWofWLMAdt3U4B8z6RWtc5gs41KMzF1dP7XaWRLnFDKwVHtTDY5AIux1beodnJLKw5AiMwUlJBLzSoJpax72r3HZ27ocW1+wWaxpkiAHC/DuvbiYA0AJJBm3qa1wZhFGXelF2+G4k7Vut2CNjaOqHFCvMBxaNvs6q0OnbtEPL4dAdiMsxBazlPxxYAimhBvaFXMwyJ96P/wp06t6d9jbEMHfaq+0g/9+5wntmTUFsDaj5swbFLhBfRkcNhWhtH0Ao+n+QQVFTpXpD1HzQrK9Bqs0FjgDjPPQpcdi6JbU0qKH+P08tJTfh/hXf47QPTR6wB4GZHx5/dDFeoTiiPBB+mxoGEm8ISnY3aqlrAUbbWsYTVi1V4WY2pfvNRNb4hElOP/8Mx3WZ4/+S71P2PJuZwvf/DvCwo+e8/mGiSOx/CAUNSUhjR5oIfO6sJKIqL49xjAdDmR+dj2df6B0ZQSWeeIkCOAYiw2fmKHrcwlRKD/GhdUcIHvqEgNgejimol5yjnZ6pTst6f4OK8IMUsjrHh6USvCx/jTa/+2PoLBIL32yTdOT3AzZyv3fATWGEJDAFdW3+ycSIzFsc/Fhcfpd4LeNSu4nrC0XPI/zTXGojbG7jW1oH4wR/LEqA/C7AVLlfpyF95VmYfRLtnQddBhSgpOM0k3wt0DWxFQ/xpsbxI4YuywtNd8u6P/kIMPZP0ijFB6yicjHtTdmsVTCweT2Qqz1H2CYewL3oZb49V1xV2LenU2eRRBiQGuKRVmKJDygJY48PjoNInwQ1m2jrG+MkHxemk/IO0og3t7sCsTR8jAiWZkn7JQw7BL3J9yg2VgyN3tIj3Ksj4E49GWiz5U5HDCh1+0xBrp0sqyv8zoMzqceTdOH8UhEdTeJ1vl0WVSWdx/WVpFomXbIzEFrFRtCm5WBDS2V1I= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- 7ftDEgLb/ZS0lcmZbHM61KDJ6AOtD78KkA7absMgUXYxWLsC+5+UYF9xVmDx9N3JNZDWAvKVpuDORXLIKnQXQzua3LPyzokSUuglaqKXwabsGM4pXku5In6gtMQMqg7sgEh1XW1iPMFgiUj/s1LdWpJHdiPjMpn7rCZNO/A31mak0K8RefoREu3BxtlAsseHWfVIIKN0U4NnA3w0Ga7XDLlF3iOIB6ImYbF6Z/7MBN2mgBr2rZ2gU1R7jNx2WKAyu4W+5zlHFnKwMISBi1CwemOo6FrxnP+Z5F9bSR7OvDBsmLj7oYD6GBgpBqj3RSAVfvfE0yZSXyCRtLeJftBbBnZq+8Y5R+O3YLHEmdWRjkeAP4vy/PMzLLbjXKP0r1BW4eYoT03JrPa/L0B0wffnS0ez96BFoTHFq52HPDCx6yhEudvoPVoM6iaVy+mvqAdvYbwBrtoypS8G1fulWTmR7qt4D+wxgTuwK0yub5gfz9wpLQCj3bimwDPi8jPeKPiggI2bWKz+7QkWvC2ihYFfEuZEsyM4ANvhxNQXIE31UkGbyf6MN51c1gY/++QRe2kEznTbCqfrOdcnPBOVfcolLq8b/gmccCeV7bCGEZisVbSQnNiaPkJ9b5I041HXc2vSx6IODB3F1IH8qANwhkbcxMPGvnUSm+rK ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/3fbe73a8120b0f25

Signatures

  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab
  • Renames multiple (253) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 29 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Encoder.28247.1335.4895.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Encoder.28247.1335.4895.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:956
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c vssadmin delete shadows /all /quiet
      2⤵
        PID:872
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 956 -s 1668
        2⤵
        • Program crash
        PID:5108
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 956 -ip 956
      1⤵
        PID:1740
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
        1⤵
          PID:2220

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\QGVSNMWIC-MANUAL.txt
          Filesize

          8KB

          MD5

          23482ef410618a7c40f818b31fa2398b

          SHA1

          88906f0b0325ac1fbbcc97e44067ad438fd6e37d

          SHA256

          fb0e6de1b4d2a5fd3a23dbf585823cb49065735003001c005ad1392e87cb7136

          SHA512

          5955523741d7fa713ec14de480ee0162e173708c2210233e7b9dd28536a221f23d763c45b9f9c6fe112816d638cb5c7948da4efb65d5e8af78794a3d712f7f45

          Download Submit

        • memory/956-1-0x0000000005540000-0x0000000005640000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/956-2-0x0000000000400000-0x00000000052B3000-memory.dmp

          Filesize

          78.7MB

          Download

        • memory/956-163-0x0000000000400000-0x00000000052B3000-memory.dmp

          Filesize

          78.7MB

          Download

        • memory/956-555-0x0000000000400000-0x00000000052B3000-memory.dmp

          Filesize

          78.7MB

          Download

        • memory/956-665-0x0000000005540000-0x0000000005640000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/956-664-0x0000000000400000-0x00000000052B3000-memory.dmp

          Filesize

          78.7MB

          Download

        • memory/956-667-0x0000000000400000-0x00000000052B3000-memory.dmp

          Filesize

          78.7MB

          Download

        • memory/956-668-0x0000000000400000-0x00000000052B3000-memory.dmp

          Filesize

          78.7MB

          Download