Analysis
- max time kernel
158s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
30/06/2024, 01:13
Behavioral task
behavioral1
Sample
2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe
Resource
win7-20240419-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe
- Size 240KB
- Sample240630-blhaps1emd
- SHA256 0837ea3c5e0a86168ded966aca50add80e1b533b99a00b4a6b5d5f6a497de146
- MD5 88c33d9670490f003390bd5b00cbc76d
- SHA1 0563481e0b88924d1f19fbe4f1afec283fe448e6
- SHA512 0faa29d0b2d62a288b47ca5ad735c3c8b2a6c7c6cd5e90bd1f845ac956de3190f6849d61024cb7347411fdd870eea77c7380f44b87ddbe33ff25a039f1a4b2b8
- SSDEEP 3072:qYHVHd2NwMqqDL2/mr3IdE8we0Avu5r++ygLIaa4jRv9OtNZpHk:qycqqDL6oREzZpE
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- GandCrab payload 3 IoCs
resource yara_rule behavioral2/memory/5068-0-0x0000000000400000-0x000000000043C000-memory.dmp family_gandcrab behavioral2/memory/5068-4-0x0000000000400000-0x000000000043C000-memory.dmp family_gandcrab behavioral2/memory/5068-18-0x0000000000400000-0x000000000043C000-memory.dmp family_gandcrab - Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
resource yara_rule behavioral2/memory/5068-0-0x0000000000400000-0x000000000043C000-memory.dmp upx behavioral2/memory/5068-4-0x0000000000400000-0x000000000043C000-memory.dmp upx behavioral2/memory/5068-18-0x0000000000400000-0x000000000043C000-memory.dmp upx - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bqarwsjnsmu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe" 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\P: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\T: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\Y: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\G: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\I: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\L: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\M: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\Q: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\R: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\U: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\Z: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\E: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\J: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\S: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\X: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\A: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\H: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\O: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\V: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\W: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\B: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\K: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 5032 taskmgr.exe Token: SeSystemProfilePrivilege 5032 taskmgr.exe Token: SeCreateGlobalPrivilege 5032 taskmgr.exe Token: 33 5032 taskmgr.exe Token: SeIncBasePriorityPrivilege 5032 taskmgr.exe - Suspicious use of FindShellTrayWindow 40 IoCs
pid Process 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe - Suspicious use of SendNotifyMessage 40 IoCs
pid Process 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe - Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 5068 wrote to memory of 3720 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 86 PID 5068 wrote to memory of 3720 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 86 PID 5068 wrote to memory of 3720 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 86 PID 5068 wrote to memory of 1968 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 95 PID 5068 wrote to memory of 1968 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 95 PID 5068 wrote to memory of 1968 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 95 PID 5068 wrote to memory of 4088 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 97 PID 5068 wrote to memory of 4088 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 97 PID 5068 wrote to memory of 4088 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 97 PID 5068 wrote to memory of 1516 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 101 PID 5068 wrote to memory of 1516 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 101 PID 5068 wrote to memory of 1516 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 101 PID 5068 wrote to memory of 3192 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 104 PID 5068 wrote to memory of 3192 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 104 PID 5068 wrote to memory of 3192 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 104 PID 5068 wrote to memory of 2372 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 106 PID 5068 wrote to memory of 2372 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 106 PID 5068 wrote to memory of 2372 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 106 PID 5068 wrote to memory of 1116 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 109 PID 5068 wrote to memory of 1116 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 109 PID 5068 wrote to memory of 1116 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 109 PID 5068 wrote to memory of 4076 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 111 PID 5068 wrote to memory of 4076 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 111 PID 5068 wrote to memory of 4076 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 111 PID 5068 wrote to memory of 4196 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 113 PID 5068 wrote to memory of 4196 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 113 PID 5068 wrote to memory of 4196 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 113 PID 5068 wrote to memory of 3124 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 117 PID 5068 wrote to memory of 3124 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 117 PID 5068 wrote to memory of 3124 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 117 PID 5068 wrote to memory of 3064 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 123 PID 5068 wrote to memory of 3064 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 123 PID 5068 wrote to memory of 3064 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 123 PID 5068 wrote to memory of 4748 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 125 PID 5068 wrote to memory of 4748 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 125 PID 5068 wrote to memory of 4748 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 125 PID 5068 wrote to memory of 4064 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 127 PID 5068 wrote to memory of 4064 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 127 PID 5068 wrote to memory of 4064 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 127 PID 5068 wrote to memory of 5104 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 132 PID 5068 wrote to memory of 5104 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 132 PID 5068 wrote to memory of 5104 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 132 PID 5068 wrote to memory of 2656 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 136 PID 5068 wrote to memory of 2656 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 136 PID 5068 wrote to memory of 2656 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 136
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:3720
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵PID:1968
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:4088
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:1516
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵PID:3192
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:2372
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:1116
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵PID:4076
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:4196
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:3124
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵PID:3064
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:4748
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:4064
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵PID:5104
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:2656
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5032