sgm.bin

General
Target

sgm.bin.dll

Filesize

40KB

Completed

12-03-2021 05:34

Score
10 /10
MD5

8a9a8739404210e7e454dc2466872f23

SHA1

a3dbb6cb1eed87147f734c933e087bd66954ca18

SHA256

8229a6d0339c001fd0ce51db1b10748d37c838baee130afea2488f2ad0e05ac4

Malware Config
Signatures 4

Filter: none

  • Nloader

    Description

    Simple loader that includes the keyword 'cambo' in the URL used to download other families.

  • Nloader Payload

    Reported IOCs

    resourceyara_rule
    behavioral2/memory/1048-3-0x0000000000650000-0x0000000000659000-memory.dmpnloader
    behavioral2/memory/1048-4-0x0000000010000000-0x0000000010007000-memory.dmpnloader
    behavioral2/memory/1048-5-0x0000000000C20000-0x0000000000C25000-memory.dmpnloader
    behavioral2/memory/1048-6-0x0000000000640000-0x0000000000647000-memory.dmpnloader
  • Blocklisted process makes network request
    rundll32.exe

    Reported IOCs

    flowpidprocess
    51048rundll32.exe
  • Suspicious use of WriteProcessMemory
    rundll32.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 832 wrote to memory of 1048832rundll32.exerundll32.exe
    PID 832 wrote to memory of 1048832rundll32.exerundll32.exe
    PID 832 wrote to memory of 1048832rundll32.exerundll32.exe
Processes 2
  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\sgm.bin.dll,#1
    Suspicious use of WriteProcessMemory
    PID:832
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\sgm.bin.dll,#1
      Blocklisted process makes network request
      PID:1048
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/1048-2-0x0000000000000000-mapping.dmp

                          • memory/1048-3-0x0000000000650000-0x0000000000659000-memory.dmp

                          • memory/1048-4-0x0000000010000000-0x0000000010007000-memory.dmp

                          • memory/1048-5-0x0000000000C20000-0x0000000000C25000-memory.dmp

                          • memory/1048-6-0x0000000000640000-0x0000000000647000-memory.dmp