Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    25-07-2024 09:51

General

  • Target

    2024-07-25_7e63315b7c7c6c0c1da5f0dab7bdfe4b_karagany_mafia.exe

  • Size

    266KB

  • MD5

    7e63315b7c7c6c0c1da5f0dab7bdfe4b

  • SHA1

    217cbd3621e86bc39c0866a70029e2aa11cd1080

  • SHA256

    bc345d907c6fde218bef52b9620066a2631bb8e47078b60363352be45ed196d5

  • SHA512

    79baf9b90cc06523882110e62b8e164a595879acaa16bff0198372157678cc95fdb89b35970b1169593ba48d858f5b32de5e2eb9ae52cc05dc2bb3c07d9aadc8

  • SSDEEP

    3072:e/yK5d0Gj0+nY3uEBLvBNfdUR2/qFnB8o2+vU3WuvIBuj00nReaXkuSQ7cdOdt:e/y20Gj0r+EBFrkvlU3RvIUDOIT

Malware Config

Signatures

  • GandCrab payload 4 IoCs
  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

  • Unexpected DNS network traffic destination 64 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • System Location Discovery: System Language Discovery 1 TTPs 58 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-07-25_7e63315b7c7c6c0c1da5f0dab7bdfe4b_karagany_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-07-25_7e63315b7c7c6c0c1da5f0dab7bdfe4b_karagany_mafia.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3008
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2600
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2576
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2484
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2572
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2984
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2244
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2192
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2432
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:536
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2716
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2848
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1296
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1816
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2548
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2128
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:856
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1404
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2444
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1748
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2332
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1984
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2180
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2908
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1612
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:308
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:348
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2932
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3068
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2840
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1908
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2252
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:276
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2408
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2752
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1812
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1232
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1588
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1084
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2568
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2744
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2740
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2872
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2532
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3060
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:832
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2144
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2436
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1964
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2792
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2856
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:444
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2316
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1676
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1244
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:932
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1860
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2088

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3008-0-0x0000000000400000-0x0000000000448000-memory.dmp

    Filesize

    288KB

  • memory/3008-3-0x0000000000560000-0x0000000000660000-memory.dmp

    Filesize

    1024KB

  • memory/3008-4-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/3008-9-0x0000000000400000-0x0000000000448000-memory.dmp

    Filesize

    288KB

  • memory/3008-7-0x0000000000250000-0x0000000000267000-memory.dmp

    Filesize

    92KB

  • memory/3008-6-0x0000000000400000-0x0000000000448000-memory.dmp

    Filesize

    288KB

  • memory/3008-16-0x0000000000560000-0x0000000000660000-memory.dmp

    Filesize

    1024KB

  • memory/3008-17-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB