egregor | 4c9e3ffda0e663217638e6192a093bbc23cd9ebfbdf6d2fc683f331beaee0321 | Triage™

Analysis

max time kernel
11s
max time network
112s
platform
windows10_x64
resource
win10v200722
submitted
05/10/2020, 13:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b3.dll
Size 790KB
Sample201005-fxp481p71j
SHA256 4c9e3ffda0e663217638e6192a093bbc23cd9ebfbdf6d2fc683f331beaee0321
MD5 a654b3a37c27810db180822b72ad6d3e
SHA1 d2d9484276a208641517a2273d96f34de1394b8e
SHA512 181027d766c0c206b4a66273bdc4df5efad3f205533eb1f8af8b01bb6d320d59c15515cd19e56f20c72476e07c1529a5a9b280bdfb57e197c3dd071077d4d4ba
MD5 SHA1 SHA512

Score

10^/10

ransomware egregor

Malware Config

Signatures

Egregor Ransomware
Variant of the Sekhmet ransomware first seen in September 2020.
ransomware egregor

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 2512	3816	rundll32.exe	68
PID 3816 wrote to memory of 2512	3816	rundll32.exe	68
PID 3816 wrote to memory of 2512	3816	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b3.dll,#1
  2⤵
  PID:2512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads