b9b71eb04d255b21e3272eef5f4c15d1c208183748dfad3569efd455d87879c6.sample

General
Target

b9b71eb04d255b21e3272eef5f4c15d1c208183748dfad3569efd455d87879c6.sample.dll

Filesize

788KB

Completed

20-10-2021 10:13

Score
10/10
MD5

e5c83994fb7a6ab58291ac93755d93a6

SHA1

e393e791368c34cf4aecc87760f3eee90d946946

SHA256

b9b71eb04d255b21e3272eef5f4c15d1c208183748dfad3569efd455d87879c6

Malware Config
Signatures 2

Filter: none

  • Egregor Ransomware

    Description

    Variant of the Sekhmet ransomware first seen in September 2020.

  • Suspicious use of WriteProcessMemory
    regsvr32.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 3464 wrote to memory of 32123464regsvr32.exeregsvr32.exe
    PID 3464 wrote to memory of 32123464regsvr32.exeregsvr32.exe
    PID 3464 wrote to memory of 32123464regsvr32.exeregsvr32.exe
Processes 3
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b9b71eb04d255b21e3272eef5f4c15d1c208183748dfad3569efd455d87879c6.sample.dll
    Suspicious use of WriteProcessMemory
    PID:3464
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\b9b71eb04d255b21e3272eef5f4c15d1c208183748dfad3569efd455d87879c6.sample.dll
      PID:3212
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    PID:1456
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/3212-115-0x0000000000000000-mapping.dmp

                          • memory/3212-116-0x0000000001120000-0x000000000115F000-memory.dmp