egregor | 61b8878801a2967f58f306223b60ab54575a879bf07884f806501b4d01e9106a

Analysis

Target

spr3.bat
Size

118B
MD5

57f297831820cb5713d32f0d6d9580b9
SHA1

57d2a1ecae9c1bdb05b2959efe65ca41487139c9
SHA256

7492ef9872b4555c6b91d39b2ebcad2d54aac2a6876d1c8e8d948500dd0c9f78
SHA512

20e8d299ec917c9281112b381944ae9b2ec717710390cbe0075a5cd999c8fdd01a75463c542dd1c504144cff0d6ab4591cfc5a304c4821ab2064527c732b09fd

Score

10^/10

Egregor Ransomware
Variant of the Sekhmet ransomware first seen in September 2020.
ransomware egregor

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 428 wrote to memory of 2788	428	cmd.exe	74
PID 428 wrote to memory of 2788	428	cmd.exe	74
PID 2788 wrote to memory of 3228	2788	rundll32.exe	76
PID 2788 wrote to memory of 3228	2788	rundll32.exe	76
PID 2788 wrote to memory of 3228	2788	rundll32.exe	76

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\spr3.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:428
- C:\Windows\system32\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\b.dll",DllRegisterServer --passegregor9 --append="antani" --multiproc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\b.dll",DllRegisterServer --passegregor9 --append="antani" --multiproc
    3⤵
    PID:3228

memory/3228-2-0x0000000004610000-0x000000000464F000-memory.dmp

Filesize
252KB

Download