Analysis
-
max time kernel
145s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
31/03/2025, 15:14
Behavioral task
behavioral1
Sample
2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe
-
Size
73KB
-
MD5
dbf610e5f5d3581a5abf5609029ac676
-
SHA1
90a6464daf06e15c46b93d965d5106589fb4f65b
-
SHA256
661e84e6434338ba37a2e6edb95482858b8131562cfc6da87ff9fe64f5751819
-
SHA512
5694f479e4bab4ec595b742f00150bbaedd777e11ac5d7fdd97cef9c21f18b9d0c4c6d62a306a63fd49d3ef1a2b35f78e18ad0426645d84656e45fb2d5735cdf
-
SSDEEP
1536:355u555555555pmgSeGDjtQhnwmmB0ybMqqU+2bbbAV2/S2mr3IdE8mne0Avu5rJ:zMSjOnrmBTMqqDL2/mr3IdE8we0Avu5h
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\okiflqlxuwf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe" 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe File opened (read-only) \??\U: 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe File opened (read-only) \??\Y: 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe File opened (read-only) \??\A: 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe File opened (read-only) \??\B: 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe File opened (read-only) \??\K: 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe File opened (read-only) \??\L: 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe File opened (read-only) \??\M: 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe File opened (read-only) \??\R: 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe File opened (read-only) \??\V: 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe File opened (read-only) \??\E: 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe File opened (read-only) \??\G: 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe File opened (read-only) \??\O: 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe File opened (read-only) \??\S: 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe File opened (read-only) \??\W: 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe File opened (read-only) \??\X: 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe File opened (read-only) \??\Z: 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe File opened (read-only) \??\H: 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe File opened (read-only) \??\I: 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe File opened (read-only) \??\Q: 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe File opened (read-only) \??\T: 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe File opened (read-only) \??\J: 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe File opened (read-only) \??\N: 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe -
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 4276 wrote to memory of 2488 4276 cmd.exe 92 PID 4276 wrote to memory of 2488 4276 cmd.exe 92 PID 4276 wrote to memory of 2488 4276 cmd.exe 92 PID 2076 wrote to memory of 3608 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 93 PID 2076 wrote to memory of 3608 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 93 PID 2076 wrote to memory of 3608 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 93 PID 2076 wrote to memory of 3532 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 100 PID 2076 wrote to memory of 3532 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 100 PID 2076 wrote to memory of 3532 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 100 PID 2076 wrote to memory of 708 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 104 PID 2076 wrote to memory of 708 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 104 PID 2076 wrote to memory of 708 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 104 PID 2076 wrote to memory of 3320 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 109 PID 2076 wrote to memory of 3320 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 109 PID 2076 wrote to memory of 3320 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 109 PID 2076 wrote to memory of 2948 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 116 PID 2076 wrote to memory of 2948 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 116 PID 2076 wrote to memory of 2948 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 116 PID 2076 wrote to memory of 1744 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 118 PID 2076 wrote to memory of 1744 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 118 PID 2076 wrote to memory of 1744 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 118 PID 2076 wrote to memory of 4888 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 120 PID 2076 wrote to memory of 4888 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 120 PID 2076 wrote to memory of 4888 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 120 PID 2076 wrote to memory of 2340 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 123 PID 2076 wrote to memory of 2340 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 123 PID 2076 wrote to memory of 2340 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 123 PID 2076 wrote to memory of 3672 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 125 PID 2076 wrote to memory of 3672 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 125 PID 2076 wrote to memory of 3672 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 125 PID 2076 wrote to memory of 4636 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 127 PID 2076 wrote to memory of 4636 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 127 PID 2076 wrote to memory of 4636 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 127 PID 2076 wrote to memory of 1428 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 129 PID 2076 wrote to memory of 1428 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 129 PID 2076 wrote to memory of 1428 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 129 PID 2076 wrote to memory of 2560 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 131 PID 2076 wrote to memory of 2560 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 131 PID 2076 wrote to memory of 2560 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 131 PID 2076 wrote to memory of 4852 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 133 PID 2076 wrote to memory of 4852 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 133 PID 2076 wrote to memory of 4852 2076 2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe 133
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
- System Location Discovery: System Language Discovery
PID:3608
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵
- System Location Discovery: System Language Discovery
PID:3532
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
- System Location Discovery: System Language Discovery
PID:708
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
- System Location Discovery: System Language Discovery
PID:3320
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵
- System Location Discovery: System Language Discovery
PID:2948
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
- System Location Discovery: System Language Discovery
PID:1744
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
- System Location Discovery: System Language Discovery
PID:4888
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵
- System Location Discovery: System Language Discovery
PID:2340
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
- System Location Discovery: System Language Discovery
PID:3672
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
- System Location Discovery: System Language Discovery
PID:4636
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵
- System Location Discovery: System Language Discovery
PID:1428
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
- System Location Discovery: System Language Discovery
PID:2560
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
- System Location Discovery: System Language Discovery
PID:4852
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe1⤵
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exeC:\Users\Admin\AppData\Local\Temp\2025-03-31_dbf610e5f5d3581a5abf5609029ac676_gandcrab_rhadamanthys.exe2⤵
- Checks processor information in registry
PID:2488
-