Analysis

  • max time kernel
    141s
  • max time network
    122s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240910-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-09-2024 16:29

General

  • Target

    2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe

  • Size

    97KB

  • MD5

    bc5c8cbbe66ca3ea05604509d334e617

  • SHA1

    084ed6abd5ded9948bf7d0a41b3c99cb35208426

  • SHA256

    79300246f195358830de5994005b0398924482e774a3244748c3b71d98b8ebaf

  • SHA512

    47fbbf0479247c0fb94f1644ebd0c170dea89d29349181a125b4afbd5eb39367951b35a9e225dc5b790a9384e359b2fc96eec0853fb0156c4b87fa2cf8ce94f0

  • SSDEEP

    1536:ufuwLvvKeqM0TRl79lvhWAwVl5OpqIyedIVjC3E8dzcrHuTcxLUllPR:umwLXnqM0Nl795twDIyeeBG+HUiUj

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-2629364133-3182087385-364449604-1000\LKVPGRA-MANUAL.txt

Family

gandcrab

Ransom Note
---= GANDCRAB V5.2 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .LKVPGRA The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/135277f19ff03ded | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAM5Kq1LioRY4okWyZFrv9NmoqQvNFF7mSelaxS81m0zmR35T2tj4sEkM2KhyxrBDkK+QFe3t4o5/+qgir2ddZ6Z976XeaNUGC7klCE+gIcT7U6pg5v/8HyX4eL+vx8tV5GGKd82bf7Ugk7W0qNnsFWH+bAImSm7Tbltl6EaAFLMDP3oIog/eTHhSedd8lpQaXFM9iqjTebvfWO8Q8pZjqkdjCsACd+xbmC01TT6mAMdlqObu1MCfwgu1Nsbw0KfJ8Qof9/NGMrfqJ1j8UoOr+AcIOINp2mqUKV/dS+9l5NiLN3vDuO14xDA0eaaSs59Jy3noPBhGBdivcsh0XxF9y6gaVkiKINWMklc/1ClMCWQUoCAkC59feHX65TxnbpThPniAFQpSKF16hwmXS6kieyzs8OJIqPVKFcH5OoNeOHgplvBqXpBvMfDXDMINctJPleoXh/8M3xBxqzeyA+9gpqIpckI1iojC5Rgf4AJTdplK4sQiT1A6Zx5QqJQXfsHtVJAt0QUwN8lt2YZtjdv36PI1me+li4NZhJRLhBXuc7qKK8+Xgkn2aGn1dicswbZ/Y5pQ3hnJfPpg+7L2Zx0XioZ3OfWuOj7FV7prc6Ptd9xBvlYbCzyfTXyukciqY/XLuk4D+7l1/j9Hj3OdcWR+MfDbNsOd6o0cpmWncKcYITdKqIzQq74FJKuOHt6b65zJDUnE0hepr88FiF1nWdtoiq/FArJUQmvtx+gx7xewrg9J3FmzI74x2/DUsujB5h/fM6jxAf4QKxllcRWyXfcdi1sk1gsy0asuv+xWBhDYCwU0cSHPsUyMaBcsV+RUZjnRtIqCyXNxONRFKsYv5yLDcwHPnFUgAortNPtCRXu4DugBYrAUBt5pk9OlsJaWNGvXzF1oJgNPWRI/xY+dqm/siPK7aWgxAz8lDSpJ1ZKxxmiMQh6Wt4UUCL5FEKNH3KXDP0QCVurjGK0nL5F3pIxeCJhmDS6dJQMUprhG4tvefIYSXGk7GgUPAKu3ZzslACynMrrBFtUJgle5wWetVWghUmtJwcdTFjsk0wFVA4AIDpb6ZR3+2zPHjmc77GDH+uScQAVwvu+MgDeC9EHjdio0kCGgYI6xMsa8SjEsd0CQOGUuvvs5TKnb6oF5VobwaozQMlkwKYE7oN0/kSs2wAzXQP/bg49JAiaMVG7SE0+78AYNYyCV36A3SRsprWqZSqs+VwCscPQiDZLRaIKBpyiaQSuThJouCXeed8nl7fZUA8WdA/MhMRJBegB54NjDCLJIn94xKQ0IxaW6Py8pnqHm/B1auauFeMrcUJlk7J9/Z3ZrrigL+iYHx2CDGuUP3DSDRwAutApkDfYSPRY0QaIL9ruLXdc8piI0EYqHBCCCXey+YSqQwl1BX6Mh3x1ovHqNdLouu1Sm52hSKE/raK407Yrikxiq7G/sMtHVFky5H273Pd1zwrU/DkhhF4fFWT8T8CqaTiObNtCrIHjlwcppm/eL9nz3elZdScJYTByIhz+bRwXbFq8RbJQq0SK/eINxHdFr4QcVBvdnMqgI98VY204isvbpztdqbqgpxeYweqx+1k4Bv4PQjTQCG7/YIXdBoAN7GQJOGE7/Ev3Occw0sPaj8yBRpTEtriW+Z7gTXlBNL4pUFnhlF4e2kiCiXcEmw7iVqPcx73qypDHoocOfT6K9dPGMEhG3q12xMJV4yUK5sdiptJ3ub27IehXFGqeAabu+qaOiy4JFGZB2mo8LCDeCMVE1zWKunluQzv52LAwZIyvC4UOildC3KgDzzwVvTLryMIlMxU5ZSgsA3vkhpf7se+Pyx/vfESFxO02fZlMtIUQPHSc1V1RwrQs5hAFQXm6yudI0fLEE1ktyxvcSmVQqLBDYbaZCvACSniIjhzTP9ya4bmhzghdTyr+DfGm1I7S/LPvtC3Z8TASWTKXVJ/yOzsD39JVz2kzRYK+7fQIuatdNiK0YwAIGQTjsjuYk/jH/S5PMkvAn+gplCTRacbfYPsBu/Ofxgw30378VIs2McO/CiaNiT/JJEhy4TehbswfalAkzFBL/xzxnUl56EJkJrWXqVsw/5oG2cFtRbEACg7hdXRQVTe/G/Qo+CinV9P+Eoxx/SHaNn2njCyn/u5gwimA96MotryhlsoHwVobBtHiYeYJZnxqL7oXrX3KPhUIo0RAXdJZzSUU2a8Dr90KSFqcmAcoO5lV4Vvtp6OFdq/T+3HHb5hmFADE//RuFVS16hRc= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- 7ftDEgLb/ZS0lcmZbHM61KDJ6AOtD78KkA7absMgUXYxWLsC+5+UYF9xVmDp9NDJK5DVAuaVs+DRRX3IKnQXQzua3LPyzokSUuglaqKXwabsGM4pXku5In6gtMQMqg7sgEh1XW1iPMFgiUj/s1LdWpJHdiPjMpn7rCZNO/A31mak0K8RefoREu3BxtlAsseHWfVIIKN0U4NnA3w0Ga7XDLlF3iOIB6ImYbF6Z/7MBN2mgBr2rZ2gU1R7jNx2WKAyu4W+5zlHFnKwMISBi1CwemOo6FrxnP+Z5F9bSR7OvDBsmLj7oYD6GBgpBqj3RSAVfvfE0yZSXyCRtLeJfNAOBiFqrMY5R+e3Z7HNmd2R2kfWP9ny//MxLOHjDaP0r1BW4eYoT03JrPa/L0B0wffnS0ez96BFoTHFq52HPDCx6yhEudvoPVoM6iaVy+mvqAdvYbwBrtoypS8G1fulWjmW7q14BOw6gT2wK0yub5gfz9wpLQCj3bimwDPi8jPeKPiggI2bWKz+7QkWvC2ihYFfEuZEsyM4ANvhxNQXIE31UkGbyf6MN51c1gY/++QRe28EznTbCqfrOdcnPBOVfcolLq8b8QmQcC6V7bCGEZisVbSQnNiaPkJ9b5I041HXc2vSx6IODB3F1IH8qANwhkbcxMPGvnUSm+rK ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/135277f19ff03ded

Signatures

  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

  • Renames multiple (311) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

  • Drops startup file 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Drops file in Program Files directory 28 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-09-28_bc5c8cbbe66ca3ea05604509d334e617_gandcrab.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1044
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c vssadmin delete shadows /all /quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1036

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2629364133-3182087385-364449604-1000\LKVPGRA-MANUAL.txt

    Filesize

    8KB

    MD5

    ca9f0688fb8d115cd24fef94a463fd9b

    SHA1

    a9c15e81ab32fb5737c115b0a3163db618a73ccd

    SHA256

    56c641f65ae8fc44637ddf1530eaec6a97dc07159b2b099f4932a23feec6118c

    SHA512

    64dc536c1147997655eb35cc0ec9d81041f3903c5a96d2e61abf206803b73440c33b36c16ec87d54fb93cbb0df39709b0b94c16621469fc59d112cf3189a379e