Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    25-07-2024 01:38

General

  • Target

    LisectAVT_2403002B_62.exe

  • Size

    308KB

  • MD5

    a4d3086ce4c817e4f7cb572a21e07b39

  • SHA1

    326e56ae3e0ea3bb869e623d37912aa67854890c

  • SHA256

    4cc124d51c471981e95c0993c4c6f44808228e4465ff2f7dbcd1e5824a8ecf39

  • SHA512

    ced8af1deb23fb5431ace0bfd0bee92191a1a8217d7b4d5a2aae0e937af53d60d23b40160f9ebfd8e5f45b42fa231ba94dbae2534e0cade26e785cd36beee8f0

  • SSDEEP

    6144:YZ5fh1s4mex2OO8bAiZ0YDChe8UN5alW6jx+J:85frs4f2OOm/Ao8UNglGJ

Malware Config

Signatures

  • GandCrab payload 4 IoCs
  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

  • Unexpected DNS network traffic destination 64 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • System Location Discovery: System Language Discovery 1 TTPs 52 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002B_62.exe
    "C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002B_62.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2780
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup politiaromana.bit ns1.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2668
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup malwarehunterteam.bit ns1.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2624
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup gdcb.bit ns2.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:584
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup politiaromana.bit ns2.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1156
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup malwarehunterteam.bit ns2.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1520
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup gdcb.bit ns1.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1932
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup politiaromana.bit ns1.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2572
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup malwarehunterteam.bit ns1.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3024
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup gdcb.bit ns2.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2256
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup politiaromana.bit ns2.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2920
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup malwarehunterteam.bit ns2.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1200
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup gdcb.bit ns1.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:684
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup politiaromana.bit ns1.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2140
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup malwarehunterteam.bit ns1.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1760
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup gdcb.bit ns2.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1620
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup politiaromana.bit ns2.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2288
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup malwarehunterteam.bit ns2.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2224
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup gdcb.bit ns1.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1696
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup politiaromana.bit ns1.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2348
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup malwarehunterteam.bit ns1.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2112
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup gdcb.bit ns2.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1164
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup politiaromana.bit ns2.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3040
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup malwarehunterteam.bit ns2.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2000
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup gdcb.bit ns1.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2324
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup politiaromana.bit ns1.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1416
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup malwarehunterteam.bit ns1.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1040
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup gdcb.bit ns2.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:620
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup politiaromana.bit ns2.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3060
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup malwarehunterteam.bit ns2.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1988
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup gdcb.bit ns1.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2368
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup politiaromana.bit ns1.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:768
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup malwarehunterteam.bit ns1.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1544
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup gdcb.bit ns2.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1628
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup politiaromana.bit ns2.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2584
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup malwarehunterteam.bit ns2.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2880
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup gdcb.bit ns1.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2636
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup politiaromana.bit ns1.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:604
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup malwarehunterteam.bit ns1.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:980
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup gdcb.bit ns2.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2060
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup politiaromana.bit ns2.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:820
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup malwarehunterteam.bit ns2.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1168
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup gdcb.bit ns1.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2144
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup politiaromana.bit ns1.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2276
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup malwarehunterteam.bit ns1.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2932
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup gdcb.bit ns2.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3064
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup politiaromana.bit ns2.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2676
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup malwarehunterteam.bit ns2.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2860
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup gdcb.bit ns1.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2976
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup politiaromana.bit ns1.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1660
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup malwarehunterteam.bit ns1.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1076
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup gdcb.bit ns2.virmach.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2268

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2780-0-0x0000000000400000-0x0000000000C3E000-memory.dmp

    Filesize

    8.2MB

  • memory/2780-2-0x0000000000CD0000-0x0000000000DD0000-memory.dmp

    Filesize

    1024KB

  • memory/2780-4-0x0000000000230000-0x0000000000246000-memory.dmp

    Filesize

    88KB

  • memory/2780-7-0x0000000000400000-0x0000000000C3E000-memory.dmp

    Filesize

    8.2MB

  • memory/2780-6-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2780-3-0x0000000000400000-0x0000000000C3E000-memory.dmp

    Filesize

    8.2MB

  • memory/2780-14-0x0000000000CD0000-0x0000000000DD0000-memory.dmp

    Filesize

    1024KB