Analysis
-
max time kernel
158s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2024 01:13
Behavioral task
behavioral1
Sample
2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe
Resource
win10v2004-20240611-en
General
-
Target
2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe
-
Size
240KB
-
MD5
88c33d9670490f003390bd5b00cbc76d
-
SHA1
0563481e0b88924d1f19fbe4f1afec283fe448e6
-
SHA256
0837ea3c5e0a86168ded966aca50add80e1b533b99a00b4a6b5d5f6a497de146
-
SHA512
0faa29d0b2d62a288b47ca5ad735c3c8b2a6c7c6cd5e90bd1f845ac956de3190f6849d61024cb7347411fdd870eea77c7380f44b87ddbe33ff25a039f1a4b2b8
-
SSDEEP
3072:qYHVHd2NwMqqDL2/mr3IdE8we0Avu5r++ygLIaa4jRv9OtNZpHk:qycqqDL6oREzZpE
Malware Config
Signatures
-
GandCrab payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/5068-0-0x0000000000400000-0x000000000043C000-memory.dmp family_gandcrab behavioral2/memory/5068-4-0x0000000000400000-0x000000000043C000-memory.dmp family_gandcrab behavioral2/memory/5068-18-0x0000000000400000-0x000000000043C000-memory.dmp family_gandcrab -
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Processes:
resource yara_rule behavioral2/memory/5068-0-0x0000000000400000-0x000000000043C000-memory.dmp upx behavioral2/memory/5068-4-0x0000000000400000-0x000000000043C000-memory.dmp upx behavioral2/memory/5068-18-0x0000000000400000-0x000000000043C000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bqarwsjnsmu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe" 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exedescription ioc process File opened (read-only) \??\N: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\P: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\T: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\Y: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\G: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\I: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\L: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\M: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\Q: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\R: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\U: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\Z: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\E: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\J: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\S: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\X: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\A: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\H: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\O: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\V: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\W: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\B: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe File opened (read-only) \??\K: 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exetaskmgr.exepid process 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 5032 taskmgr.exe Token: SeSystemProfilePrivilege 5032 taskmgr.exe Token: SeCreateGlobalPrivilege 5032 taskmgr.exe Token: 33 5032 taskmgr.exe Token: SeIncBasePriorityPrivilege 5032 taskmgr.exe -
Suspicious use of FindShellTrayWindow 40 IoCs
Processes:
taskmgr.exepid process 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe -
Suspicious use of SendNotifyMessage 40 IoCs
Processes:
taskmgr.exepid process 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe -
Suspicious use of WriteProcessMemory 45 IoCs
Processes:
2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exedescription pid process target process PID 5068 wrote to memory of 3720 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 3720 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 3720 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 1968 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 1968 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 1968 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 4088 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 4088 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 4088 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 1516 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 1516 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 1516 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 3192 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 3192 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 3192 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 2372 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 2372 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 2372 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 1116 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 1116 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 1116 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 4076 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 4076 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 4076 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 4196 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 4196 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 4196 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 3124 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 3124 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 3124 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 3064 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 3064 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 3064 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 4748 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 4748 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 4748 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 4064 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 4064 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 4064 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 5104 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 5104 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 5104 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 2656 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 2656 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe PID 5068 wrote to memory of 2656 5068 2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe nslookup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-29_88c33d9670490f003390bd5b00cbc76d_gandcrab.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/5032-17-0x0000021B26790000-0x0000021B26791000-memory.dmpFilesize
4KB
-
memory/5032-7-0x0000021B26790000-0x0000021B26791000-memory.dmpFilesize
4KB
-
memory/5032-6-0x0000021B26790000-0x0000021B26791000-memory.dmpFilesize
4KB
-
memory/5032-5-0x0000021B26790000-0x0000021B26791000-memory.dmpFilesize
4KB
-
memory/5032-13-0x0000021B26790000-0x0000021B26791000-memory.dmpFilesize
4KB
-
memory/5032-16-0x0000021B26790000-0x0000021B26791000-memory.dmpFilesize
4KB
-
memory/5032-15-0x0000021B26790000-0x0000021B26791000-memory.dmpFilesize
4KB
-
memory/5032-14-0x0000021B26790000-0x0000021B26791000-memory.dmpFilesize
4KB
-
memory/5032-12-0x0000021B26790000-0x0000021B26791000-memory.dmpFilesize
4KB
-
memory/5032-11-0x0000021B26790000-0x0000021B26791000-memory.dmpFilesize
4KB
-
memory/5068-4-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/5068-0-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/5068-18-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB