Analysis

  • max time kernel
    136s
  • max time network
    101s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-05-2024 21:44

General

  • Target

    2024-05-04_10d1cab850b70a94cb9b699aef8c99bc_karagany_mafia.exe

  • Size

    283KB

  • MD5

    10d1cab850b70a94cb9b699aef8c99bc

  • SHA1

    45a2d578dfd64cef3996952939c2fcfb85f85538

  • SHA256

    d079fceb5b300c7d0acec20cc6b84fda4ea37f6b6f0f29d1bade4a6d213d0afb

  • SHA512

    47fb947c49bd8305686ecf9fca0797ee1779377012ea0cf0b840bca75067d70e8f43e552dc96191201b0fd30b8b4b2bf0c4e2b7da91ff1d2649fa528c6f29912

  • SSDEEP

    6144:46jtiQHr3ByVh4YDI/MlCm5mFW9tmLxLP9+Eiu9Uo9hNqnvT8vRiXdx97/uciL:4GTghljl+wKl1+/u9Uovsr8vRiXdx97C

Malware Config

Signatures

  • GandCrab payload 3 IoCs
  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

  • Detects Reflective DLL injection artifacts 3 IoCs
  • Detects ransomware indicator 3 IoCs
  • Gandcrab Payload 3 IoCs
  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-04_10d1cab850b70a94cb9b699aef8c99bc_karagany_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-04_10d1cab850b70a94cb9b699aef8c99bc_karagany_mafia.exe"
    1⤵
      PID:3324
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 468
        2⤵
        • Program crash
        PID:4348
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3324 -ip 3324
      1⤵
        PID:1700

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/3324-1-0x00000000006A0000-0x00000000007A0000-memory.dmp

        Filesize

        1024KB

      • memory/3324-2-0x0000000000400000-0x000000000042C000-memory.dmp

        Filesize

        176KB

      • memory/3324-4-0x0000000001F80000-0x0000000001F97000-memory.dmp

        Filesize

        92KB

      • memory/3324-3-0x0000000000400000-0x000000000044C000-memory.dmp

        Filesize

        304KB

      • memory/3324-8-0x0000000000400000-0x000000000042C000-memory.dmp

        Filesize

        176KB