Overview

overview

10

Static

static

10

017b236bf3...d6.exe

windows7-x64

10

017b236bf3...d6.exe

windows10-2004-x64

10

05676f2007...fb.exe

windows7-x64

3

05676f2007...fb.exe

windows10-2004-x64

7

0a025116a8...57.exe

windows7-x64

8

0a025116a8...57.exe

windows10-2004-x64

8

$PLUGINSDIR/INetC.dll

windows7-x64

3

$PLUGINSDIR/INetC.dll

windows10-2004-x64

3

1.exe

windows7-x64

8

1.exe

windows10-2004-x64

8

18674bbd9a...38.exe

windows7-x64

8

18674bbd9a...38.exe

windows10-2004-x64

8

$PLUGINSDIR/INetC.dll

windows7-x64

3

$PLUGINSDIR/INetC.dll

windows10-2004-x64

3

234901adb1...b2.exe

windows7-x64

10

234901adb1...b2.exe

windows10-2004-x64

10

2ae06537d1...b6.exe

windows7-x64

8

2ae06537d1...b6.exe

windows10-2004-x64

8

$PLUGINSDIR/INetC.dll

windows7-x64

3

$PLUGINSDIR/INetC.dll

windows10-2004-x64

3

2c02c65090...91.exe

windows7-x64

7

2c02c65090...91.exe

windows10-2004-x64

7

3.exe

windows7-x64

10

3.exe

windows10-2004-x64

10

329b3ddbf1...f9.exe

windows7-x64

10

329b3ddbf1...f9.exe

windows10-2004-x64

10

336fe6e8bc...de.exe

windows7-x64

8

336fe6e8bc...de.exe

windows10-2004-x64

8

$PLUGINSDIR/INetC.dll

windows7-x64

3

$PLUGINSDIR/INetC.dll

windows10-2004-x64

3

4bd31921c8...be.exe

windows7-x64

8

4bd31921c8...be.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    119s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20-11-2024 13:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    234901adb1100979c1e842133901f0bb8617683efeed4e3d56245f71f71aa6b2.exe

  • Size

    93KB

  • MD5

    bdbca2193b35706fef4ce9368af7a886

  • SHA1

    216e8cf79eced5dba6365b1648cb8ca126ef0cae

  • SHA256

    234901adb1100979c1e842133901f0bb8617683efeed4e3d56245f71f71aa6b2

  • SHA512

    af70ab8b4738a2c5a7869f202a850357d71cb43d67498b87525924dfbd2f456254d0ecb4c2651797b2ec75c3717cf0a4433a7d7573a27bbb55ac644c75009a49

  • SSDEEP

    1536:7w2p3ieRXCkxEoSXf6GizDhp2keW8PaoYEXOcrHuTc+N:cSyex5yoSPmzKkeW8iEXjHU

Score
10/10
gandcrabbackdoorcredential_accessdefense_evasiondiscoveryexecutionimpactransomwarespywarestealer

Malware Config

Extracted

Path

F:\$RECYCLE.BIN\S-1-5-21-3290804112-2823094203-3137964600-1000\WELENDZZNL-MANUAL.txt

Family

gandcrab

Ransom Note
---= GANDCRAB V5.2 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .WELENDZZNL The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/34d2ee38d03c3cf | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAEVlwVQsezbhotkpr3Ao8/iZyVgFsTQMN0ta4AKvSvQAUUtX2it8vVzTSFnZVCxltbZnYDAi/nLOs1Gv6OSxTrtbA/e8SpQbQOQF0t9V+xqn9YHZAqCKcjVEBAvHiet2eQNHKYGWqQThMDEKdNzvQlyou3d4WZTayPo4bXNJREEQp445m/aSZWEJQBtouTelswMNb6GTz8p7nEcPiFJAYYECFR11sxsmnjKOun7L2IfP5QVKhra2EsTLnKTbOZzAyLHRFZRITM7Rj3BNmDDZMowIphzJ/atP6goe3DiCHAKDaCOxf3hogMiB2U44PftaPehyYQ/+pqoH6fzjt6UdZ3tWqAyb9CHefTZUJTa68rQZHhoJdOV4q29rVOBnGzDm1hOopRp3T2M65hJnHH6nc8boh+y0yb3WtwjNYLojuua3/1zLLuz6Zd22/nwtbW73uA5Kaqr9zPPa7Cc4gW1t6UUdJ/4XcyQa65ZmVMXsFy/89qM+1h0YpEcd0GvvozjQ7uBydCAACy7O29ucIjx7lFoiNkR16FRQbQVXbDD9+7j7B/SIqyK+SBs0bbxKdvzygShS52vFEmJ57Cee2GY1If1xfog7nN3l7vaY4Qbqz34rP3/Df0TpmjHI3Pq7krNHQu181de46ONKfqPs0BBzWTfeg0UliKATCFgUudngl3ys3bu5kD1Oq55vL99mmgFvHtIqItocfutQMhRs7NPCJmyH7AFp4IGTN1LLXFibhNS71ZhmCCqSfti0X4s3Riqf+bOwbe9IGaoeqVA6UGAcJuFSahHdFQD3vCk/Mt1Dkut/YoOm3W937n96Gpp/WMfi5giuWjWnDwwANzzVvUKQF6K9nWyDLzl+nJelAPoBxGkNBSe1NxRNmInYzBUx0i90+cMWwyZuUCNbjBMXNGdxH6FNWzuI5Tnx8mRSwUxDTu40mw1XdYIgeEzGL413u2KvAQnP6pkNGMQM7gZYjC1T7SS1shIqAO8a3kQU7JywqI3Gt450ICVlgk3Q1kQTk9XNNKy2akGZYCdszoutNDcHlcRbiZLg1hN2QYN5/ZwBTiLS1ePR24PRO/sOlT+Wu94oIGRzXg6u5T5lRvMmGFZArWk4njusXlZNRusr231sqBClWrCKid/e9HhzRcy2GIQnD88qH/Jkj5UkRRPAm6gVMkI50GhgdCn79mlI1YnVG6Oa2GUCp9cn3hEGpKbo4UPWGZ1Uvo5D8GvHlMYXioje1XrlmnKJaLLGQ1eo8xkGM6bFjJiJqrOisHPf1yYm1ez3i1sTe2O7vzYzzN7uTY8Lz/GPKhDD45nxbYEV3E4RMap6nhD3mUq1A5oGhZuawGjedUZXiGmtPv42BoBrt2L/RX7J4w70wNAp9dG7m44iZ2dGBSM5YXevII6Oorskp0Wt9H5z68j2vFEKgOCKQV++pg0tyhcZ+vjogpaTLf5Iu5pnSQ1T6rNWItGw/LS1Pv10Rg+287URheNd2TTn/hWlTSHQcf/I19MFzo1yuL2BThGYDZRzqvMbZ0ebBZON/ea28YTiQaI+gEvgaYflCvcWcYLsewxQeX5O1/7gxA6u3A6J2EOWbN9SmlXMuiqOdiBvH6eF53Qsg9NU6N7NzxOxJlC3J4CQX5VAy+hpxLSiP2HEyFddRHLTYgwgLjVHOJ2gKgbVDp70wLwihgz0VxVGOgj46inUpPXBQo9KJ+pLxr39L+7nf9bGxVbSObwGRczX2VcLiPP8JFBrV6tEuc3Aotu1iQt2gg1HFtSrbA7wTuTI5Lm55v+JJlNiumvbPhRKaBzokB6DmGB0C7E998qD3VzHDtMFkeWCNO6igE4pQKq64WgSML55EJ9wipDh8K/JKV2AYfPy7ZUCShzraFoy9Cbung8ytrezF3vxY1E5ry3gJC8SEBO32cJnM7Hc5jg5YR/AcE4qLd6lBThaZDMESx4kzwAOABVPXHOuUV2O1CV7JWTAvJLN8QXtEo/oCpVJvWKizZo/orsD8QsZIqtvCYFj9RIx86LcJP/HVAWMERJhoGg6bwG+nRTuFXhELEjgTcq9H8ndrP1F8ayfxt/JnqIqYSqXx/87jbiOMkTXjVD0P08k2sidGYzhot53dQA/v3u/32aM4KMuPH29+KXkuGGx6GU5+nde8+xpcGlO4kPsaQ4F+phDP/iwzcXlpqY0LiwvSO6kXG8zoCeH/2A5+fO2/zmzxtmUrk0qUunqsMuWRyFMDy6yzgurV/+MCxbQGdeseJI= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- 7ftDEgLb/ZS0lcmZbHM61KDJ6AOtD78KkA7absMgUXYxWLsC+5+UYF9xVmDo9NPJLpDSAvSVp+DBRWnIKnQXQzua3LPyzokSUuglaqKXwabsGM4pXku5In6gtMQMqg7sgEh1XW1iPMFgiUj/s1LdWpJHdiPjMpn7rCZNO/A31mak0K8RefoREu3BxtlAsseHWfVIIKN0U4NnA3w0Ga7XDLlF3iOIB6ImYbF6Z/7MBN2mgBr2rZ2mU0R7+dxfWLoypoW25ypHEnKnMMuBl1Cmehqo5VrrnNSZu19KSVzOtTAymPz79ICyGBkpCKj0RQwVePfN00RSBSDBtO6Jf9BYBnFqrcY2R7S3MbHPmYeRj0fTP4/y6vM9LODjDaPvr3tWv+YKTznJt/bAL0J01/eNSzezgKAqoTvFqJ2HPDmx5ShGudnoMloV6iCVyemoqB5vYrwCrt0ypS8F1fOlXjmT7rN4cOwygU+wTkywb+cfzdw/LWqjqbjWwFvi9DPXKP+ghY2cWKz+6gkLvCeiiYFcEv1EtSM9ANLhxdQDIBf1BEGWyeqMZp0P1h0/u+RWez0Et3TBCrbrZtdJPEmVKsoqLrgbsAnNcG2VuLCZEZKsSbTenISaf0Ihb4k0t1Gacy3SiKIADBDFnYH2qA1whEaNxA== ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/34d2ee38d03c3cf

Signatures

  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab
  • Gandcrab family
    gandcrab
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (298) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 47 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\234901adb1100979c1e842133901f0bb8617683efeed4e3d56245f71f71aa6b2.exe
    "C:\Users\Admin\AppData\Local\Temp\234901adb1100979c1e842133901f0bb8617683efeed4e3d56245f71f71aa6b2.exe"
    1⤵
    • Drops startup file
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1920
    • C:\Windows\SysWOW64\wbem\wmic.exe
      "C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:1148
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2688

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • F:\$RECYCLE.BIN\S-1-5-21-3290804112-2823094203-3137964600-1000\WELENDZZNL-MANUAL.txt
    Filesize

    8KB

    MD5

    b3e2394be39b81f3df2bff637b1fc49a

    SHA1

    ba369ad1a3641db8e7de1b94cac2a29f11a5c5b9

    SHA256

    6e43be73d8cbabe4474ae2ef65f8a3aa569c4868b311e0075df914ba6376f29f

    SHA512

    e7a8b5ecac53f3c7457b054960e9097f3407d65a1687d77081f5101ccbd26cd97325ebc660eb64cbd119545b7574b5ac5c1596b16792875fbd6ffcd15ec0802e

    Download Submit