Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    22-12-2024 03:00

General

  • Target

    21f6bc83c707a1c0ec31fecd6177b15b19889ed803feb81c49d342f520fed6e1.exe

  • Size

    256KB

  • MD5

    8b21acfb205bab287d171915d5a3dae5

  • SHA1

    43088b9e3cc2fe637be983f921240c4d0c0cc3db

  • SHA256

    21f6bc83c707a1c0ec31fecd6177b15b19889ed803feb81c49d342f520fed6e1

  • SHA512

    3d2f239fe85f792babbe2e43888e1e8efd6c1fb93833733488d6a8810916745c3508986cca08dd36941d44846214239d39d2fcc3594b37c4537856068a92733b

  • SSDEEP

    6144:rhvaHGULrgyWh0/Ro/FbzneuttdQPLAumwrS5:1aH30h0/RoZ7euttCsumwO5

Malware Config

Signatures

  • GandCrab payload 4 IoCs
  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

  • Gandcrab family
  • Unexpected DNS network traffic destination 64 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\21f6bc83c707a1c0ec31fecd6177b15b19889ed803feb81c49d342f520fed6e1.exe
    "C:\Users\Admin\AppData\Local\Temp\21f6bc83c707a1c0ec31fecd6177b15b19889ed803feb81c49d342f520fed6e1.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2324
    • C:\Windows\SysWOW64\nslookup.exe
      nslookup carder.bit ns1.wowservers.ru
      2⤵
        PID:760
      • C:\Windows\SysWOW64\nslookup.exe
        nslookup ransomware.bit ns2.wowservers.ru
        2⤵
        • System Location Discovery: System Language Discovery
        PID:3048
      • C:\Windows\SysWOW64\nslookup.exe
        nslookup carder.bit ns2.wowservers.ru
        2⤵
        • System Location Discovery: System Language Discovery
        PID:964
      • C:\Windows\SysWOW64\nslookup.exe
        nslookup ransomware.bit ns1.wowservers.ru
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2888
      • C:\Windows\SysWOW64\nslookup.exe
        nslookup carder.bit ns1.wowservers.ru
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2776
      • C:\Windows\SysWOW64\nslookup.exe
        nslookup ransomware.bit ns2.wowservers.ru
        2⤵
          PID:2628
        • C:\Windows\SysWOW64\nslookup.exe
          nslookup carder.bit ns2.wowservers.ru
          2⤵
          • System Location Discovery: System Language Discovery
          PID:2932
        • C:\Windows\SysWOW64\nslookup.exe
          nslookup ransomware.bit ns1.wowservers.ru
          2⤵
          • System Location Discovery: System Language Discovery
          PID:2908
        • C:\Windows\SysWOW64\nslookup.exe
          nslookup carder.bit ns1.wowservers.ru
          2⤵
          • System Location Discovery: System Language Discovery
          PID:2664
        • C:\Windows\SysWOW64\nslookup.exe
          nslookup ransomware.bit ns2.wowservers.ru
          2⤵
            PID:2632
          • C:\Windows\SysWOW64\nslookup.exe
            nslookup carder.bit ns2.wowservers.ru
            2⤵
            • System Location Discovery: System Language Discovery
            PID:2032
          • C:\Windows\SysWOW64\nslookup.exe
            nslookup ransomware.bit ns1.wowservers.ru
            2⤵
            • System Location Discovery: System Language Discovery
            PID:2140
          • C:\Windows\SysWOW64\nslookup.exe
            nslookup carder.bit ns1.wowservers.ru
            2⤵
            • System Location Discovery: System Language Discovery
            PID:860
          • C:\Windows\SysWOW64\nslookup.exe
            nslookup ransomware.bit ns2.wowservers.ru
            2⤵
            • System Location Discovery: System Language Discovery
            PID:2352
          • C:\Windows\SysWOW64\nslookup.exe
            nslookup carder.bit ns2.wowservers.ru
            2⤵
            • System Location Discovery: System Language Discovery
            PID:1992
          • C:\Windows\SysWOW64\nslookup.exe
            nslookup ransomware.bit ns1.wowservers.ru
            2⤵
            • System Location Discovery: System Language Discovery
            PID:2868
          • C:\Windows\SysWOW64\nslookup.exe
            nslookup carder.bit ns1.wowservers.ru
            2⤵
            • System Location Discovery: System Language Discovery
            PID:1504
          • C:\Windows\SysWOW64\nslookup.exe
            nslookup ransomware.bit ns2.wowservers.ru
            2⤵
            • System Location Discovery: System Language Discovery
            PID:2848
          • C:\Windows\SysWOW64\nslookup.exe
            nslookup carder.bit ns2.wowservers.ru
            2⤵
            • System Location Discovery: System Language Discovery
            PID:1764
          • C:\Windows\SysWOW64\nslookup.exe
            nslookup ransomware.bit ns1.wowservers.ru
            2⤵
            • System Location Discovery: System Language Discovery
            PID:1772
          • C:\Windows\SysWOW64\nslookup.exe
            nslookup carder.bit ns1.wowservers.ru
            2⤵
            • System Location Discovery: System Language Discovery
            PID:3000
          • C:\Windows\SysWOW64\nslookup.exe
            nslookup ransomware.bit ns2.wowservers.ru
            2⤵
              PID:3028
            • C:\Windows\SysWOW64\nslookup.exe
              nslookup carder.bit ns2.wowservers.ru
              2⤵
                PID:2444
              • C:\Windows\SysWOW64\nslookup.exe
                nslookup ransomware.bit ns1.wowservers.ru
                2⤵
                • System Location Discovery: System Language Discovery
                PID:2132
              • C:\Windows\SysWOW64\nslookup.exe
                nslookup carder.bit ns1.wowservers.ru
                2⤵
                  PID:1620
                • C:\Windows\SysWOW64\nslookup.exe
                  nslookup ransomware.bit ns2.wowservers.ru
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:912
                • C:\Windows\SysWOW64\nslookup.exe
                  nslookup carder.bit ns2.wowservers.ru
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:1952
                • C:\Windows\SysWOW64\nslookup.exe
                  nslookup ransomware.bit ns1.wowservers.ru
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:740
                • C:\Windows\SysWOW64\nslookup.exe
                  nslookup carder.bit ns1.wowservers.ru
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:928
                • C:\Windows\SysWOW64\nslookup.exe
                  nslookup ransomware.bit ns2.wowservers.ru
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:1496
                • C:\Windows\SysWOW64\nslookup.exe
                  nslookup carder.bit ns2.wowservers.ru
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:984
                • C:\Windows\SysWOW64\nslookup.exe
                  nslookup ransomware.bit ns1.wowservers.ru
                  2⤵
                    PID:1736
                  • C:\Windows\SysWOW64\nslookup.exe
                    nslookup carder.bit ns1.wowservers.ru
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:2200
                  • C:\Windows\SysWOW64\nslookup.exe
                    nslookup ransomware.bit ns2.wowservers.ru
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:2812
                  • C:\Windows\SysWOW64\nslookup.exe
                    nslookup carder.bit ns2.wowservers.ru
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:2724
                  • C:\Windows\SysWOW64\nslookup.exe
                    nslookup ransomware.bit ns1.wowservers.ru
                    2⤵
                      PID:300
                    • C:\Windows\SysWOW64\nslookup.exe
                      nslookup carder.bit ns1.wowservers.ru
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:980
                    • C:\Windows\SysWOW64\nslookup.exe
                      nslookup ransomware.bit ns2.wowservers.ru
                      2⤵
                        PID:1740
                      • C:\Windows\SysWOW64\nslookup.exe
                        nslookup carder.bit ns2.wowservers.ru
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:876
                      • C:\Windows\SysWOW64\nslookup.exe
                        nslookup ransomware.bit ns1.wowservers.ru
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:2408
                      • C:\Windows\SysWOW64\nslookup.exe
                        nslookup carder.bit ns1.wowservers.ru
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:2328
                      • C:\Windows\SysWOW64\nslookup.exe
                        nslookup ransomware.bit ns2.wowservers.ru
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:2044
                      • C:\Windows\SysWOW64\nslookup.exe
                        nslookup carder.bit ns2.wowservers.ru
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:1988
                      • C:\Windows\SysWOW64\nslookup.exe
                        nslookup ransomware.bit ns1.wowservers.ru
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:308
                      • C:\Windows\SysWOW64\nslookup.exe
                        nslookup carder.bit ns1.wowservers.ru
                        2⤵
                          PID:2896
                        • C:\Windows\SysWOW64\nslookup.exe
                          nslookup ransomware.bit ns2.wowservers.ru
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:2772
                        • C:\Windows\SysWOW64\nslookup.exe
                          nslookup carder.bit ns2.wowservers.ru
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:2756
                        • C:\Windows\SysWOW64\nslookup.exe
                          nslookup ransomware.bit ns1.wowservers.ru
                          2⤵
                            PID:2332
                          • C:\Windows\SysWOW64\nslookup.exe
                            nslookup carder.bit ns1.wowservers.ru
                            2⤵
                              PID:2112
                            • C:\Windows\SysWOW64\nslookup.exe
                              nslookup ransomware.bit ns2.wowservers.ru
                              2⤵
                              • System Location Discovery: System Language Discovery
                              PID:2760
                            • C:\Windows\SysWOW64\nslookup.exe
                              nslookup carder.bit ns2.wowservers.ru
                              2⤵
                              • System Location Discovery: System Language Discovery
                              PID:2624
                            • C:\Windows\SysWOW64\nslookup.exe
                              nslookup ransomware.bit ns1.wowservers.ru
                              2⤵
                              • System Location Discovery: System Language Discovery
                              PID:2668
                            • C:\Windows\SysWOW64\nslookup.exe
                              nslookup carder.bit ns1.wowservers.ru
                              2⤵
                              • System Location Discovery: System Language Discovery
                              PID:2688
                            • C:\Windows\SysWOW64\nslookup.exe
                              nslookup ransomware.bit ns2.wowservers.ru
                              2⤵
                              • System Location Discovery: System Language Discovery
                              PID:2440
                            • C:\Windows\SysWOW64\nslookup.exe
                              nslookup carder.bit ns2.wowservers.ru
                              2⤵
                              • System Location Discovery: System Language Discovery
                              PID:1320
                            • C:\Windows\SysWOW64\nslookup.exe
                              nslookup ransomware.bit ns1.wowservers.ru
                              2⤵
                              • System Location Discovery: System Language Discovery
                              PID:2956
                            • C:\Windows\SysWOW64\nslookup.exe
                              nslookup carder.bit ns1.wowservers.ru
                              2⤵
                              • System Location Discovery: System Language Discovery
                              PID:268
                            • C:\Windows\SysWOW64\nslookup.exe
                              nslookup ransomware.bit ns2.wowservers.ru
                              2⤵
                              • System Location Discovery: System Language Discovery
                              PID:1560
                            • C:\Windows\SysWOW64\nslookup.exe
                              nslookup carder.bit ns2.wowservers.ru
                              2⤵
                              • System Location Discovery: System Language Discovery
                              PID:2852
                            • C:\Windows\SysWOW64\nslookup.exe
                              nslookup ransomware.bit ns1.wowservers.ru
                              2⤵
                              • System Location Discovery: System Language Discovery
                              PID:2964
                            • C:\Windows\SysWOW64\nslookup.exe
                              nslookup carder.bit ns1.wowservers.ru
                              2⤵
                                PID:3016
                              • C:\Windows\SysWOW64\nslookup.exe
                                nslookup ransomware.bit ns2.wowservers.ru
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:3036
                              • C:\Windows\SysWOW64\nslookup.exe
                                nslookup carder.bit ns2.wowservers.ru
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:2276
                              • C:\Windows\SysWOW64\nslookup.exe
                                nslookup ransomware.bit ns1.wowservers.ru
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:2060
                              • C:\Windows\SysWOW64\nslookup.exe
                                nslookup carder.bit ns1.wowservers.ru
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:1464
                              • C:\Windows\SysWOW64\nslookup.exe
                                nslookup ransomware.bit ns2.wowservers.ru
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:2160
                              • C:\Windows\SysWOW64\nslookup.exe
                                nslookup carder.bit ns2.wowservers.ru
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:1564
                              • C:\Windows\SysWOW64\nslookup.exe
                                nslookup ransomware.bit ns1.wowservers.ru
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:600
                              • C:\Windows\SysWOW64\nslookup.exe
                                nslookup carder.bit ns1.wowservers.ru
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:684
                              • C:\Windows\SysWOW64\nslookup.exe
                                nslookup ransomware.bit ns2.wowservers.ru
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:1680
                              • C:\Windows\SysWOW64\nslookup.exe
                                nslookup carder.bit ns2.wowservers.ru
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:1700
                              • C:\Windows\SysWOW64\nslookup.exe
                                nslookup ransomware.bit ns1.wowservers.ru
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:2508
                              • C:\Windows\SysWOW64\nslookup.exe
                                nslookup carder.bit ns1.wowservers.ru
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:628
                              • C:\Windows\SysWOW64\nslookup.exe
                                nslookup ransomware.bit ns2.wowservers.ru
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:288
                              • C:\Windows\SysWOW64\nslookup.exe
                                nslookup carder.bit ns2.wowservers.ru
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:696
                              • C:\Windows\SysWOW64\nslookup.exe
                                nslookup ransomware.bit ns1.wowservers.ru
                                2⤵
                                  PID:2116
                                • C:\Windows\SysWOW64\nslookup.exe
                                  nslookup carder.bit ns1.wowservers.ru
                                  2⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2280

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • memory/2324-1-0x00000000005C0000-0x00000000006C0000-memory.dmp

                                Filesize

                                1024KB

                              • memory/2324-2-0x0000000000400000-0x000000000042C000-memory.dmp

                                Filesize

                                176KB

                              • memory/2324-3-0x0000000000400000-0x000000000048A000-memory.dmp

                                Filesize

                                552KB

                              • memory/2324-4-0x0000000000230000-0x0000000000247000-memory.dmp

                                Filesize

                                92KB

                              • memory/2324-11-0x00000000005C0000-0x00000000006C0000-memory.dmp

                                Filesize

                                1024KB

                              • memory/2324-12-0x0000000000400000-0x000000000042C000-memory.dmp

                                Filesize

                                176KB

                              • memory/2324-13-0x0000000000400000-0x000000000048A000-memory.dmp

                                Filesize

                                552KB