gandcrab | fed171b68db2c9c99b135d028050c27456eb0268c8b0b46e0a6fb7e50647f073

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 04:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_9c010c8d2d51ab37b9b744c8540827dd_elex_gandcrab.exe
Size 69KB
Sample260824-eldt3axzgw
SHA256 fed171b68db2c9c99b135d028050c27456eb0268c8b0b46e0a6fb7e50647f073
MD5 9c010c8d2d51ab37b9b744c8540827dd
SHA1 d28426df19dfb380fda00bc5fa6379bb7d6a1707
SHA512 9b8514abe0d7f8b417fe63bfd344a9c7fe012cab21624cf88e8832eccb9f177e7b0f237f958793bad06a02598583e1f4aaf4fcf7170069aefb3d45040f2ae6af
SSDEEP 1536:qZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAmMqqU+2bbbAV2/S2Lccu:cBounVyFHjMqqDL2/Lcc
TLSH
T170636A0EB2E1A193F1F357B9FAB56E65486E3D203B249BDB4893594529630F0793B303
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery gandcrab ransomware

Malware Config

Signatures

Family: Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab

GandCrab payload 1 IoCs

resource	yara_rule
behavioral2/memory/4320-0-0x000000000F490000-0x000000000F4A6000-memory.dmp	family_gandcrab

Detects Reflective DLL injection artifacts 1 IoCs

resource	yara_rule
behavioral2/memory/4320-0-0x000000000F490000-0x000000000F4A6000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects ransomware indicator 1 IoCs

resource	yara_rule
behavioral2/memory/4320-0-0x000000000F490000-0x000000000F4A6000-memory.dmp	SUSP_RANSOMWARE_Indicator_Jul20

Gandcrab Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4320-0-0x000000000F490000-0x000000000F4A6000-memory.dmp	Gandcrab

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3552	4320	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_9c010c8d2d51ab37b9b744c8540827dd_elex_gandcrab.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-23_9c010c8d2d51ab37b9b744c8540827dd_elex_gandcrab.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_9c010c8d2d51ab37b9b744c8540827dd_elex_gandcrab.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4320
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 396
  2⤵
  - Program crash
  PID:3552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 4320 -ip 4320
1⤵
PID:4104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4320-0-0x000000000F490000-0x000000000F4A6000-memory.dmp

Download