Analysis

  • max time kernel
    134s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-07-2024 17:25

General

  • Target

    bfb9db791b8250ffa8ebc48295c5dbbca757a5ed3bbb01de12a871b5cd9afd5a.exe

  • Size

    291KB

  • MD5

    e6b43b1028b6000009253344632e69c4

  • SHA1

    e536b70e3ffe309f7ae59918da471d7bf4cadd1c

  • SHA256

    bfb9db791b8250ffa8ebc48295c5dbbca757a5ed3bbb01de12a871b5cd9afd5a

  • SHA512

    07da214314673407a7d3978ee6e1d20bf1e02f135bf557e86b50489ecc146014f2534515c1b613dba96e65489d8c82caaa8ed2e647684d61e5e86bd3e8251adf

  • SSDEEP

    6144:nSRCSpUtLz+/enihebWBUOP3yIhLVMmi0CtG7go+I:SUOEnNnHbmP3yIE3tGX

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-1176886754-713327781-2233697964-1000\MTHQLT-MANUAL.txt

Family

gandcrab

Ransom Note
---= GANDCRAB V5.2 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .MTHQLT The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/d833ad75ba1fb46b | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAALx3EQFHDtFqxIUn2/MT3pmvdrRZP8kCyrUFpLliKNVFJNdbHZoxbA5k69T6tSgmutyiNkZ9/2Pwhk24lhZAWw1+O7KrLQQmo2tONbWcMRjkQTYpW+7pDu6o60HPdsGPt6/19uCzfQTgjYIaMGPnijIGPS8jbWJhhDymwM85P9j8y0pzeYCr16Fn4m8/RibZg+gy71Rz2jFyfYdL5aYrivem9mtJ5XxCmkba/Aj2TXGnuMRNWqAZ0mwTXnVJIkk50wWovW/Hgi2TJl6ifzfwj9JBpPrXgVxStt3j3ANi/zdX/0e5Og8K0SrBDW6u+zNsz6hNYRDAWbErByOr/M685ZWwngeg0Jf04jSe7bGRWqY6kP3E83IokP9AV7Fa6yDgi1SLqd1oVRgazQ0dgELVmfwt9ngqb5TXYuNmVG9rYUEHRodyjGHo4q975aYHH2T/vTy1g5/3HBQ0tXLje5rCiMiK3dZjWTnqBA+HtxLrjXT3SlusnyjqRaVssZleCZXuVlpXUGFMj7cLKA/a7+qm6NTCaR1pU082QGWCzzEoI+xIxQwRrB905oQ3/FNK0PLvNeExw+ZnFaaER/8juiixSui+aBlp86orru6rEqmsVG1lbLWsifiWXh0Jd7+VqwS6g+EZWH/NDMbPFSqdVGuRyPNftYnOxw4E5yB8aB/vaZykh6AwQU5KAGZPaKnSjqfmCAJ4Mu6nWtXZVabfZgQ6o92LSyiT1yPu20y91zCxdyR/+3tDwx6YnqpxA5i+Lynws2qmdEihUwxa+zGI1KNRpvGiNWULPVVyhzxlLGUGGsZ7kFTnO3zTfU+AHdOLdqfgJmHun8b+VqBHhxm7sQ8hrbxwXH99RTWDcA3xWvWUDLU/L9u+7Uu7le52CORFZhbyGiJTAIPTwOaCnOLMQ4d8NB2GCNAzq6dhRVJfRBhRi3GTx9zrlJK3aXSDkm0YLIPIdc7e58Bx+/JWJGjKZaS/84ERigbcp8KaKOmU7NAck++huUEZ3N2FHC8PvhybZkwQLkLiigDi1SVxy0erI4dglpU4Yh/Xi24XdfjzHbzo60Md+8vYQpL1BskE+1IGbRrVJLuX/mHpClrUCuVezT0sGCWFA0Z3WHdhp9lsr3U/qeoR1xuJXcV5wEcs8RcU+TPadU8ek0741y15MDiEL7rCljOsEDQslSEfTv9PDQupvM2Xg5Ts/DcV4tEXKto6sAlZugeFLFQhn7vr+4hcRSh4kCtYNMzlm9yDttCe+XFF0MsFxDCjKcT3AU1tDoU2XnG6BTX2gx8Dmyhz/1gl6gD25Zn87S0/7TJ5jx5ReJsvU4OaCwY33ySpaO3aDbMQ7a4orxUs8+0+EpWcFdHF5TnamYyCPevrHq8q81Cc7GsG/I4dHQKOFIuCZ3sHw4JgVJDSUxc5qaEMLt9amhFylxEaGVQBmmkMcljK1Ljvc71mb/SkKP4MgN7sbrL0oN0dY7koA/kqxhZmXAsutnWFfiad65neLycimqjZR3JEANv1ypVVMbABfCAdbsYcWZiqIy5zBrWWyarfaN3lIzzxb+IDz7YJyJrCNQBreN/yJzHxmivjaNDHDzz7IT68G6IkrgWdj0JRjY078sZ6LYk1zw6FImO7pzxkG6N7H1mlHJ6xT+12GX2l11849gFeyikP5xEhD3CSWUHBAP8dPo8BPFluvVTVsM2wpGzpuna5QS0Ks02NJBe8RV48BPu5ySRexXS6MUatjjg7EW6GJgE0udrfnZpqLELUoyVRBBz/JJV8ig8OfPWjR7cJKYMaEzHxMzVHS9Jv696dXNidM+lDqSgoVr8u4zkGFV2UyLzqmK0RKZxd4HDs777pPaB/qEzx/R/69RaWSlf7BEvEsPYFSgr22reQ6fM22iZU/kmgE8eG9pG8fH4lqzL7xRBCXzkvNFTal1yMmmEUA9eXmqtEKMaiEFsg6sXKzBMqaFoF/f3TKYIIpzhfDfByLDuvMEmY6gG1nNoqgjQmvnaESxQ+FW5MymvyufC8Rzx7l6ZE7Ic/73gjwj1XtOoC3oYhyeU3EKMzvKFJ56GurFLCfzwQOotNwRn012mETK8v3Yu1/i4YosFRh0QIJ/pfitBPIvWfF8FeLqYyg5Xq0cp9dMNPa2FWnPR5RfZhbKRHoyQKVK7nrOJT62je5NlkwC+A//dMklv7q3Oqr7YbZN7PFzmh9UqbdalAzAUyVRv9aaV98C4SZGA6kgs11EYwVewI0TQsaOILeKpT9WI= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- 7ftDEgLb/ZS0lcmZbHM61KDJ6AOtD78KkA7absMgUXYxWLsC+5+UYF9xVmDm9MbJPpDLAvyVr+DMRW3IKnQXQzua3LPyzokSUuglaqKXwabsGM4pXku5In6gtMQMqg7sgEh1XW1iPMFgiUj/s1LdWpJHdiPjMpn7rCZNO/A31mak0K8RefoREu3BxtlAsseHWfVIIKN0U4NnA3w0Ga7XDLlF3iOIB6ImYbF6Z/7MBN2mgBr2rZ2gU1R7jNx2WKAyu4W+5zlHFnKwMISBi1CwemOo6FrxnP+Z5F9bSR7OvDBsmLj7oYD6GBgpBqj3RSAVfvfE0yZSXyCRtLeJKdAFBidqrcZvR7S3NrHJmYaR3UeBP4/yrvNhLLLjC6P0r1BW4eYoT03JrPa/L0B0wffnS0ez96BFoTHFq52HPDCx6yhEudvoPVoM6iaVy+mvqAdvYbwBrtoypS8G1fulWjmW7q14BOw6gT2wK0yub5gfz9wpLQCj3bimwDPi8jPeKPiggI2bWKz+7QkWvC2ihYFfEuZEsyM4ANvhxNQXIE31UkGbyf6MN51c1gY/++QRe2kEznTbCqfrOdcnPBOVfcolLq8b/gmccCeV7bCGEZisVbSQnNiaPkJ9b5I041HXc2vSx6IODB3F1IH8qANwhkbcxMPGvnUSm+rK ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/d833ad75ba1fb46b

Signatures

  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

  • Renames multiple (315) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

  • Drops startup file 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Drops file in Program Files directory 23 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bfb9db791b8250ffa8ebc48295c5dbbca757a5ed3bbb01de12a871b5cd9afd5a.exe
    "C:\Users\Admin\AppData\Local\Temp\bfb9db791b8250ffa8ebc48295c5dbbca757a5ed3bbb01de12a871b5cd9afd5a.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1020
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c vssadmin delete shadows /all /quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4512
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 1440
      2⤵
      • Program crash
      PID:3124
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1020 -ip 1020
    1⤵
      PID:2176

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-1176886754-713327781-2233697964-1000\MTHQLT-MANUAL.txt

      Filesize

      8KB

      MD5

      eda59f94a87c1e386a1ed8976a0ac963

      SHA1

      e8708ae595652a9ec04f01b82c2b89253258bf7f

      SHA256

      c685b8d17245533b8e1aca3eea47a64bd78466f0f7a3f5ac2ffeafe3c694e630

      SHA512

      7e3f46cb944d18c6f36303bd381f1f4e93b9172bbd60cc4258094956dab9f5b1c79bd5acb613a838a0ac9abc377f4df54b0f30672f106c5f776db6c00a45321d

    • memory/1020-1-0x0000000005650000-0x0000000005750000-memory.dmp

      Filesize

      1024KB

    • memory/1020-2-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

    • memory/1020-819-0x0000000000400000-0x00000000052B3000-memory.dmp

      Filesize

      78.7MB

    • memory/1020-822-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

    • memory/1020-821-0x0000000000400000-0x00000000052B3000-memory.dmp

      Filesize

      78.7MB