Overview

overview

10

Static

static

3

CrazyNCS.exe

windows10-ltsc 2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    CrazyNCS.exe

  • Size

    122KB

  • Sample

    250303-ahzj5szps2

  • MD5

    d043ba91e42e0d9a68c9866f002e8a21

  • SHA1

    e9f177e1c57db0a15d1dc6b3e6c866d38d85b17c

  • SHA256

    6820c71df417e434c5ad26438c901c780fc5a80b28a466821b47d20b8424ef08

  • SHA512

    3e9783646e652e9482b3e7648fb0a5f7c8b6c386bbc373d5670d750f6f99f6137b5501e21332411609cbcc0c20f829ab8705c2835e2756455f6754c9975ac6bd

  • SSDEEP

    1536:frNvVsJysJYUjwRBRZ+dtf9naYlN4ZqhOn6w92znPIW+M2TlT8KV2enfBA2yYd1:zNv+JyS0DZ+hJlMn6w92zgnMq85f2v

Score
10/10
crimsonratgandcrabbackdoorcredential_accessdefense_evasiondiscoverypersistenceransomwareratspywarestealertrojan

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-1786400979-876203093-3022739302-1000\RGZCNUO-MANUAL.txt

Family

gandcrab

Ransom Note
---= GANDCRAB V5.2 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .RGZCNUO The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/faedc421c26182e0 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAACnDKFjfDFoDx6FKJ2aSIFbp2Xq+bk5QgyXAJTF7YOvaWzRey5yJ+o1w41QJVeHJFcTrIhyKtNyUr8zwAW6kjiQip6LH2YmMdygnyvMBx5MJVzLHtRg0cwynDqmjtn2Lufjo6q3fXv6x34Pv+dPWibVDwtcpeja8LWkArXYIAKOil7cKOF+g82/dH0B54xTTUIYxWRQ+YF1MMjpoIqH3ui8wS/y74AbURb8MJPxf1voV5NbffrDAydEkW2e2laVqaGDs0Q+rHHhO8VK7iydBM3DUluaUypIhLqhhRnjNMVjKbgmfH6Qimz2IP9RFBVPxEI8JcXyNcROB+EdgTzw4TxwDMex1jIMs90rueyGEv6quNnL/TEwswNY/C1QkCv+sjcOmPwsWPfwcYMNlcHCUbl25ORGoMXpTvIyA054w+B1xHvIAYGEq++PnLgSjM5wG2cNdLvtWgacJYN/9Wy4h86Q0CbQremMbmv9JxEIxKbX0ir35uTT8gZWxI8+/yyuMD5QHMue6sPESNjNAxnRLZP+FKO2N3Sk4PXN3ocUDP5ceyGU4F57sUcgATIXz7uvF7yRc7R1OmwvkY03/As/7R3eVwWkQmk+7KVHHatQEosLIB7gWVAvou2QlyhA2PGbnaZSJv45SANGC2B9tX3zDGW6Rsu/BQEbYjKo6OeUoQ3a38sUEzVDqw1ZjH82CN7U6Et4ePXBQmOxXPV+dy0NdkE6UpgnnWUiUuIXhurGZiWQnJfEf66S4aPJbB05ohJ3WkLAiLaz7ut37RZdMK+Kw/vlcVuN8f5JFsiDJYNcc1UnikNu0IDQWPMCDSGwP/t+e1G6ukWCguPJhasuqMTk2IEo6jgsSShWW9hEsYInxG7+r4DkufN72Xye6OPu/cLQI92E5YcvIPuBlE6igwJ0Ae8oEFv8NL2eEHZzSfnzXFS+eqomcpHtbd3T/O/r54arLq/iZTgX5cdYmGfP44ShGDZvuYsqRo02edZO2uJLLqq6WH+ioph9IRghmAnwD0GdDJsMxQrGDyqgF+G3V+6HH/oTExEMVRBFn76bMnYx1LHN8WtlaqhsbzdWGkRRAm5I2sCii4+TuKTcKG7PS9+pCtRLsXTORoYqeHtdYD+OUmndGgVlYWSzVdeEXDnofXkmGUadY7/E4W1L6DV8JghG+7Z6gnkP6sslODPcdNM4Iz6FawLXzGGRNkpJh+9EAOZ/R6MBOFt/5m0ThcUyiPDw9BxlKNxWC5x7BcqgtDp/yTaIQ4tFL75wrVwopCNb17xoXWr3jshR8A2bJ5DUYq7d8IFxK4jpajyJDTTuZJiOCHWC365kKPt1sLfz0ZkLY4eNwVCV8BlfJ4pBDGEctBXpjjfG939YwW6CW1gguB3o3yPanfRvpgj7TfClzpc6rJ/HYE5rMBmwGbAgwN8a7RGyoKs3qhmKPesEComnB4KkCQLcIwZ6CayOcvyK73mCGa31yzEKRgw/huNfXTP76MeZ963HoldmMo5aJltSEAacd4GPS5JcFnl4WeRjfDgipaPnZ86zU4SEy0crGRaI3osEkwgIPJ/R6mtVhy9hj+Nx9U+VdN5l2w1p3osbdd7rA9NtCUA/ZclOKZ8uumgUR1Xtw5qEZHF/1P2zEj+fYqZqPD+DDdaZgjJAdWjSjzoMqk9NAbIERjMcw1rTw5qxsifIA24zW91PGV0z90JPKO2wl1Mk1eLxj58UCXekR5581eYENuUF9TFTKHSARyVy1NNonFmBDdZJo/x986/VKJ9z2kGkuf4RIzvD3jSFolBpMn2Qt6p+ix0pqW9bSoXqHY2YBXnVURlanijvxMZMWSnoxXSPr+0QveXKMzDoga96O1hL4XjbDovziOiSQ89TNypU6bb24F+WS5URWw61PvdubV14lCFMGyj/m2ZJbLLlwFF2esRkm/T8meQYKrPUzUD2YEccVdlou6iWHNuvMPEkgjagGvSbtrvJKAN4r+iH0eMVhme8JbCS3PzWee0FXW9JXxutnNJRk9yJy51GUDIv+OmfoU+mb2j1VIZyG9R3dT8RAzF7A60vtbSnYIfKM+GM4+Rn0oOaHvBkf4LsUDXLwDthKtTpsuC9BAgmf+6y8G8t023HPNm4fMim/uxoyc/xxIaQZ3hywGaLsT1u2Cci0KwgSHqI3HRmuxCINU35FkxN2oF5Q+cG75XqkpTSu9MTaUVGX/NHlqIuqrsOEmN/tFi1Sv8UkvJfWE65XKGHuDDf0I3LTV9Q= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- 7ftDEgLb/ZS0lcmZbHM61KDJ6AOtD78KkA7absMgUXYxWLsC+5+UYF9xVmDq9NbJPpDcAvWVruDERWfIKnQXQzua3LPyzokSUuglaqKXwabsGM4pXku5In6gtMQMqg7sgEh1XW1iPMFgiUj/s1LdWpJHdiPjMpn7rCZNO/A31mak0K8RefoREu3BxtlAsseHWfVIIKN0U4NnA3w0Ga7XDLlF3iOIB6ImYbF6Z/7MBN2mgBr2rZ2gU1R7jNx2WKAyu4W+5zlHFnKwMISBi1CwemWoy1rWnPOZxV8SSVjOsTAmmL/7s4CzGBkpOKj7RToVZfeU0wFSACDBtKyJP9BcBnpq7cZhR723XrGVmYCRgUfWP4jyqfMxLOfjXaPgrwlW5uZ+T0bJ3va9LzR07fePSySz26B+oWfFo533PDqxlSg7ubDoQVp+6k2Vw+mvqB9vZLwArtkyoC8O1f2lWTmY7ql4GewxgT2wMUzab5sfvNxQLWyjrrjTwFji9DPDKIqgjY3pWN3+hglhvFqi4oFZEvhEsSM+AN7hzdQWIEz1U0GTyeyMcZ0O1go/+eQSe20E23SaCuLrfdcRPB6VJMorLqwb8AmOcGyVvrCSEaKsTrSHnIyaYEIrb5s07lHfcy/ShKIdDA3FyYH6qAJw1UbUxI7G7XVYm+fKMPMuEsCdCZihzgpfE7oT7wA2q18= ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/faedc421c26182e0

Targets

    • Target

      CrazyNCS.exe

    • Size

      122KB

    • MD5

      d043ba91e42e0d9a68c9866f002e8a21

    • SHA1

      e9f177e1c57db0a15d1dc6b3e6c866d38d85b17c

    • SHA256

      6820c71df417e434c5ad26438c901c780fc5a80b28a466821b47d20b8424ef08

    • SHA512

      3e9783646e652e9482b3e7648fb0a5f7c8b6c386bbc373d5670d750f6f99f6137b5501e21332411609cbcc0c20f829ab8705c2835e2756455f6754c9975ac6bd

    • SSDEEP

      1536:frNvVsJysJYUjwRBRZ+dtf9naYlN4ZqhOn6w92znPIW+M2TlT8KV2enfBA2yYd1:zNv+JyS0DZ+hJlMn6w92zgnMq85f2v

    Score
    10/10
    crimsonratgandcrabbackdoorcredential_accessdefense_evasiondiscoverypersistenceransomwareratspywarestealertrojan

    • CrimsonRAT main payload

    • CrimsonRat

      Crimson RAT is a malware linked to a Pakistani-linked threat actor.

      ratcrimsonrat

    • Crimsonrat family

      crimsonrat

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • Gandcrab family

      gandcrab

    • Modifies visibility of file extensions in Explorer

      defense_evasion

    • UAC bypass

      defense_evasiontrojan

    • Renames multiple (332) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

5
T1112

Subvert Trust Controls

1
T1553

SIP and Trust Provider Hijacking

1
T1553.003

Credential Access

Credentials from Password Stores

2
T1555

Credentials from Web Browsers

1
T1555.003

Windows Credential Manager

1
T1555.004

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

4
T1012

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Defacement

1
T1491

Tasks