General

  • Target

    fd41a85fecd92233e3a6f76a292c3b4a060b10b96f19d40558aa77da9fcb01e7

  • Size

    241KB

  • Sample

    240528-qyh54agg64

  • MD5

    bb9dc812fc9fb41880f5acdaaad8e7c9

  • SHA1

    d0bc1f239afb0a8a6e7cf06d7c4c199de146dd75

  • SHA256

    fd41a85fecd92233e3a6f76a292c3b4a060b10b96f19d40558aa77da9fcb01e7

  • SHA512

    9318dcb03fbf7ecef5c6d26f0c3d579388921f3897d81b7a8a59fbd82414b7844a652ad4637a2ecfc81cc7865afc058a2806ff6c5357d4fea69c52bf5ef7e929

  • SSDEEP

    3072:nn5L1Q3Tn9PdkT+q8qE/7Mnu7BG6+OoHI+rTi9kCA1KXyC7Qg79prbwJ0hKpD:depcd8/iLo+rTKkXnCrvhKl

Malware Config

Targets

    • Target

      fd41a85fecd92233e3a6f76a292c3b4a060b10b96f19d40558aa77da9fcb01e7

    • Size

      241KB

    • MD5

      bb9dc812fc9fb41880f5acdaaad8e7c9

    • SHA1

      d0bc1f239afb0a8a6e7cf06d7c4c199de146dd75

    • SHA256

      fd41a85fecd92233e3a6f76a292c3b4a060b10b96f19d40558aa77da9fcb01e7

    • SHA512

      9318dcb03fbf7ecef5c6d26f0c3d579388921f3897d81b7a8a59fbd82414b7844a652ad4637a2ecfc81cc7865afc058a2806ff6c5357d4fea69c52bf5ef7e929

    • SSDEEP

      3072:nn5L1Q3Tn9PdkT+q8qE/7Mnu7BG6+OoHI+rTi9kCA1KXyC7Qg79prbwJ0hKpD:depcd8/iLo+rTKkXnCrvhKl

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

    • Detects Reflective DLL injection artifacts

    • Detects ransomware indicator

    • Gandcrab Payload

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

3
T1012

Peripheral Device Discovery

2
T1120

System Information Discovery

3
T1082

Tasks