egregor | a376fd507afe8a1b5d377d18436e5701702109ac9d3e7026d19b65a7d313b332 | Triage

Analysis

max time kernel
13s
max time network
112s
platform
windows10_x64
resource
win10v200722
submitted
11-10-2020 22:18

Sharing

Report Analysis Logs

General

Target

b.bin.dll
Size

788KB
MD5

16a9c2917577e732cd6630b08e248443
SHA1

bd8c52bb1f5c034f11f3048e2ed89b7b8ff39261
SHA256

a376fd507afe8a1b5d377d18436e5701702109ac9d3e7026d19b65a7d313b332
SHA512

b2e14e06f6dd26da9743c5d94977c69d1c77d487d26ebceb32874ef693818ea75e9247b015a9251bba0d41da8029a7dc13585c6a0df28f7e33d36f9f4fdbdf12

Score

10^/10

ransomware egregor

Malware Config

Signatures

Egregor Ransomware
Variant of the Sekhmet ransomware first seen in September 2020.
ransomware egregor

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 408 wrote to memory of 988	408	rundll32.exe	68
PID 408 wrote to memory of 988	408	rundll32.exe	68
PID 408 wrote to memory of 988	408	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b.bin.dll,#1
  2⤵
  PID:988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads