Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
08-11-2021 09:40
Static task
static1
Behavioral task
behavioral1
Sample
4c9e3ffda0e663217638e6192a093bbc23cd9ebfbdf6d2fc683f331beaee0321.dll
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
4c9e3ffda0e663217638e6192a093bbc23cd9ebfbdf6d2fc683f331beaee0321.dll
Resource
win10-en-20211104
General
-
Target
4c9e3ffda0e663217638e6192a093bbc23cd9ebfbdf6d2fc683f331beaee0321.dll
-
Size
790KB
-
MD5
a654b3a37c27810db180822b72ad6d3e
-
SHA1
d2d9484276a208641517a2273d96f34de1394b8e
-
SHA256
4c9e3ffda0e663217638e6192a093bbc23cd9ebfbdf6d2fc683f331beaee0321
-
SHA512
181027d766c0c206b4a66273bdc4df5efad3f205533eb1f8af8b01bb6d320d59c15515cd19e56f20c72476e07c1529a5a9b280bdfb57e197c3dd071077d4d4ba
Malware Config
Signatures
-
Egregor Ransomware
Variant of the Sekhmet ransomware first seen in September 2020.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 60 wrote to memory of 4036 60 regsvr32.exe regsvr32.exe PID 60 wrote to memory of 4036 60 regsvr32.exe regsvr32.exe PID 60 wrote to memory of 4036 60 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\4c9e3ffda0e663217638e6192a093bbc23cd9ebfbdf6d2fc683f331beaee0321.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\4c9e3ffda0e663217638e6192a093bbc23cd9ebfbdf6d2fc683f331beaee0321.dll2⤵