Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    25-07-2024 09:51

General

  • Target

    2024-07-25_3190848a7ef90c28a527abbba5ef6a53_karagany_mafia.exe

  • Size

    250KB

  • MD5

    3190848a7ef90c28a527abbba5ef6a53

  • SHA1

    db2d6fbfc17e2de178ddda6b2a8f1946b65eae54

  • SHA256

    f0707ea68e6eb316e6d1f19fc4a64cf8ecea66473eb71581d748ba769e3cd1a9

  • SHA512

    76e53ddc5f31692b393c4136dfa864cedd59926fe41f41f2931e9a178ba0a62eea5198415fdee2a6fe60e3547cca6715101f5ea6d7979cce1f6d00ab66994b2c

  • SSDEEP

    6144:G+YrOIBjaklexBgiJ8sTSIkIpxIp8mDtfPBRwasxXa:yOCjaklYgVIpxIhDtJ

Malware Config

Signatures

  • GandCrab payload 4 IoCs
  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

  • Unexpected DNS network traffic destination 64 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • System Location Discovery: System Language Discovery 1 TTPs 59 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-07-25_3190848a7ef90c28a527abbba5ef6a53_karagany_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-07-25_3190848a7ef90c28a527abbba5ef6a53_karagany_mafia.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2660
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2136
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2816
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2632
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2540
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3024
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3028
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3048
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1384
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1508
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2308
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2276
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2772
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2284
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:632
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1848
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3064
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1436
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:328
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2184
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2196
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2120
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2216
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2860
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1792
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1312
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2492
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1064
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2012
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:336
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2248
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1104
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:340
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2472
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2032
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1536
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1512
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1740
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1668
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1576
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2648
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2000
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2788
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1336
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2364
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3016
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2564
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2236
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1964
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2820
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:788
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2756
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2252
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1240
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2224
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2192
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2376
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2060
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup ransomware.bit ns2.wowservers.ru
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2124

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2660-0-0x0000000000220000-0x000000000023B000-memory.dmp

    Filesize

    108KB

  • memory/2660-1-0x0000000000220000-0x000000000023B000-memory.dmp

    Filesize

    108KB

  • memory/2660-2-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/2660-3-0x0000000000400000-0x0000000000444000-memory.dmp

    Filesize

    272KB

  • memory/2660-4-0x00000000002E0000-0x00000000002F7000-memory.dmp

    Filesize

    92KB

  • memory/2660-6-0x0000000000400000-0x0000000000444000-memory.dmp

    Filesize

    272KB

  • memory/2660-14-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB