Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-05-2024 17:14

General

  • Target

    2024-05-05_be9f14c63bf3286c35525f3783167e77_karagany_mafia.exe

  • Size

    326KB

  • MD5

    be9f14c63bf3286c35525f3783167e77

  • SHA1

    2b7e5992463c3a15abe0e40039b419472ff680ec

  • SHA256

    deef2d9d64e96ce625dffe398d56abd37beef94d74db4cc53a7acd756d2dbd33

  • SHA512

    d326782c7b022a862913002065ab7312639825bcacfc7cc762d7325c86456437cca9a2751f503e84cdcac3562586740ed11a7f30a74b70457057da78ee4aca66

  • SSDEEP

    3072:C+V2GtCb0nDlMTM87yRBNWwxnImfoP/KOBejjY6IaCDtm0zT5363kQ8JuY:CB/muTXkLHgPitjYVmq+k

Malware Config

Signatures

  • GandCrab payload 3 IoCs
  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

  • Detects Reflective DLL injection artifacts 3 IoCs
  • Detects ransomware indicator 2 IoCs
  • Gandcrab Payload 3 IoCs
  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-05_be9f14c63bf3286c35525f3783167e77_karagany_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-05_be9f14c63bf3286c35525f3783167e77_karagany_mafia.exe"
    1⤵
      PID:4464
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 472
        2⤵
        • Program crash
        PID:5048
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4464 -ip 4464
      1⤵
        PID:3584

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/4464-1-0x0000000000400000-0x00000000012D6000-memory.dmp

        Filesize

        14.8MB

      • memory/4464-3-0x0000000000400000-0x000000000042C000-memory.dmp

        Filesize

        176KB

      • memory/4464-2-0x0000000001320000-0x0000000001420000-memory.dmp

        Filesize

        1024KB

      • memory/4464-4-0x0000000000400000-0x00000000012D6000-memory.dmp

        Filesize

        14.8MB

      • memory/4464-5-0x0000000002F10000-0x0000000002F27000-memory.dmp

        Filesize

        92KB

      • memory/4464-9-0x0000000000400000-0x000000000042C000-memory.dmp

        Filesize

        176KB