egregor | 61b8878801a2967f58f306223b60ab54575a879bf07884f806501b4d01e9106a | Triage

Analysis

max time kernel
30s
max time network
29s
platform
windows7_x64
resource
win7v20201028
submitted
04-11-2020 21:59

Sharing

Report Analysis Logs

General

Target

spr3.bat
Size

118B
MD5

57f297831820cb5713d32f0d6d9580b9
SHA1

57d2a1ecae9c1bdb05b2959efe65ca41487139c9
SHA256

7492ef9872b4555c6b91d39b2ebcad2d54aac2a6876d1c8e8d948500dd0c9f78
SHA512

20e8d299ec917c9281112b381944ae9b2ec717710390cbe0075a5cd999c8fdd01a75463c542dd1c504144cff0d6ab4591cfc5a304c4821ab2064527c732b09fd

Score

10^/10

egregor ransomware

Malware Config

Signatures

Egregor Ransomware
Variant of the Sekhmet ransomware first seen in September 2020.
ransomware egregor

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2028 wrote to memory of 1444	2028	cmd.exe	rundll32.exe
PID 2028 wrote to memory of 1444	2028	cmd.exe	rundll32.exe
PID 2028 wrote to memory of 1444	2028	cmd.exe	rundll32.exe
PID 1444 wrote to memory of 1992	1444	rundll32.exe	rundll32.exe
PID 1444 wrote to memory of 1992	1444	rundll32.exe	rundll32.exe
PID 1444 wrote to memory of 1992	1444	rundll32.exe	rundll32.exe
PID 1444 wrote to memory of 1992	1444	rundll32.exe	rundll32.exe
PID 1444 wrote to memory of 1992	1444	rundll32.exe	rundll32.exe
PID 1444 wrote to memory of 1992	1444	rundll32.exe	rundll32.exe
PID 1444 wrote to memory of 1992	1444	rundll32.exe	rundll32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\spr3.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\b.dll",DllRegisterServer --passegregor9 --append="antani" --multiproc
2⤵
- Suspicious use of WriteProcessMemory
PID:1444

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\b.dll",DllRegisterServer --passegregor9 --append="antani" --multiproc
3⤵
PID:1992

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1444-0-0x0000000000000000-mapping.dmp

Download
memory/1992-1-0x0000000000000000-mapping.dmp

Download
memory/1992-2-0x00000000001A0000-0x00000000001DF000-memory.dmp

Filesize
252KB

Download