egregor | 61b8878801a2967f58f306223b60ab54575a879bf07884f806501b4d01e9106a

Analysis

Target

spr3.bat
Size

118B
MD5

57f297831820cb5713d32f0d6d9580b9
SHA1

57d2a1ecae9c1bdb05b2959efe65ca41487139c9
SHA256

7492ef9872b4555c6b91d39b2ebcad2d54aac2a6876d1c8e8d948500dd0c9f78
SHA512

20e8d299ec917c9281112b381944ae9b2ec717710390cbe0075a5cd999c8fdd01a75463c542dd1c504144cff0d6ab4591cfc5a304c4821ab2064527c732b09fd

Score

10^/10

Egregor Ransomware
Variant of the Sekhmet ransomware first seen in September 2020.
ransomware egregor

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1444	2028	cmd.exe	27
PID 2028 wrote to memory of 1444	2028	cmd.exe	27
PID 2028 wrote to memory of 1444	2028	cmd.exe	27
PID 1444 wrote to memory of 1992	1444	rundll32.exe	28
PID 1444 wrote to memory of 1992	1444	rundll32.exe	28
PID 1444 wrote to memory of 1992	1444	rundll32.exe	28
PID 1444 wrote to memory of 1992	1444	rundll32.exe	28
PID 1444 wrote to memory of 1992	1444	rundll32.exe	28
PID 1444 wrote to memory of 1992	1444	rundll32.exe	28
PID 1444 wrote to memory of 1992	1444	rundll32.exe	28

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\spr3.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\system32\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\b.dll",DllRegisterServer --passegregor9 --append="antani" --multiproc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1444
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\b.dll",DllRegisterServer --passegregor9 --append="antani" --multiproc
    3⤵
    PID:1992

memory/1992-2-0x00000000001A0000-0x00000000001DF000-memory.dmp

Filesize
252KB

Download