egregor | b720aa9c58b19eec96664d807ffeef3518655dea880cdc71bbb6b037e1da7c2d

Sharing

Copy URL

Twitter E-mail

General

Target

file_c64c98fff70dddee178417535d2c997b_2024-05-10_11_55_03_386000.zip
Size

162.6MB
Sample

240510-n8k2bsgf28
MD5

a58317fcbc88889410ee09fd7d646aaf
SHA1

f9dc939cbd5404b84f77ff339c25b3bf065c8f1d
SHA256

b720aa9c58b19eec96664d807ffeef3518655dea880cdc71bbb6b037e1da7c2d
SHA512

c9bcdcdce774452cb2fda53186fa3b11229f45a154835db84d9166abb1302df3706fc68b988df675680c8423875868c9db74f21e23caa1c22f40ee4d178ffa3b
SSDEEP

3145728:1sRt0gno9PuAemXzhXkJodyTxtk+KFVGyRBgdYlYuMhK0fzw+qR3h:WRtU9PuARDhXSuqmFVHcYlYuMh7zu3h

Score

10^/10

Malware Config

Targets

- Target
  
  entry_1_0/installer.exe
- Size
  
  162.5MB
- MD5
  
  28cbc2fad63f2102520cce77f889a5d4
- SHA1
  
  0cd0972e886c0cd24b29935d76d047e89c3fa15f
- SHA256
  
  dcb1ffc5c1f1a67d1d6b4e9cad95e629cabd2533da2882eeebdef10f1692e3d0
- SHA512
  
  f5b3979d5c4d7bddb6ac2655b22397e6a1c8661aae8eb1dafa3606da9ea1c7aeb5eb3488f2cabff7b2bea511f7b087664436521a1611aceb76c7cf87bbbbf1a0
- SSDEEP
  
  3145728:bUjOi1gUrJsaeyFtANw5MPCbhDGUM5TYYNB0Ho9pAGT6UdHC6u6O:YjOWrJsadrAN8ysO5TRMo9pAGTHHlO
Score

10^/10

egregor discovery ransomware
- Detected Egregor ransomware
- Egregor Ransomware
  Variant of the Sekhmet ransomware first seen in September 2020.
  ransomware egregor
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/SpiderBanner.dll
- Size
  
  9KB
- MD5
  
  17309e33b596ba3a5693b4d3e85cf8d7
- SHA1
  
  7d361836cf53df42021c7f2b148aec9458818c01
- SHA256
  
  996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- SHA512
  
  1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP
  
  192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
Score

1^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/WinShell.dll
- Size
  
  3KB
- MD5
  
  1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1
  
  0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA256
  
  9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- SHA512
  
  7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
Score

3^/10
behavioral10 behavioral9
- Target
  
  Guardian Browser.exe
- Size
  
  158.3MB
- MD5
  
  aafa839b0874605018b2e3ec6a34dbcf
- SHA1
  
  c17fc2bbee408800bc0fb1dbb324bfc3bb504528
- SHA256
  
  f4fdbbdcba6145bb277958790eb5bc62130485e704acef4682574d6ef2a73c17
- SHA512
  
  0b89277eea60e92c9a0694f9d45e4f62301a887df777f03679ede04f5982042050cb39ae7117669b7b640e13f780182b99257086c772a0fd2a6ba8eb2a3cb69d
- SSDEEP
  
  1572864:0bVZx8PLGKEULTQ9hm/C1tdUKYjgTwFoKnRQwsu/YfWXV/NiisGItlAdgAnEk0H1:zvCqSkRm
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral11 behavioral12
- Target
  
  LICENSES.chromium.html
- Size
  
  8.4MB
- MD5
  
  e400cd908b8fb7c13985e2f5cc7a7044
- SHA1
  
  bbafebdf5b067a7d7da130025851eaa52ec3c9d7
- SHA256
  
  ee3b1ab8794c749673ce9bd2dd302f12d69f0a1a4adfe40a64247746cc311829
- SHA512
  
  e7ca440f0e042d7fcfa99367426bf19899a2b227c6d7b6e2c25d4f1a40113250f21ebeaaf91067d8569dfbad1415d4fe3e5626d7254722f2778497fcb22e5d6e
- SSDEEP
  
  24576:/UrV6CI675knWSgRBPyQlrUmf1C6C6y6Z6/678HqBMUpuQ:MsWKA
Score

1^/10
behavioral13 behavioral14
- Target
  
  d3dcompiler_47.dll
- Size
  
  4.7MB
- MD5
  
  2191e768cc2e19009dad20dc999135a3
- SHA1
  
  f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA256
  
  7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- SHA512
  
  5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP
  
  49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
Score

1^/10
behavioral15
- Target
  
  ffmpeg.dll
- Size
  
  2.7MB
- MD5
  
  15c3cc618663ad92e772556bf7d1558d
- SHA1
  
  49beb2598fbaf01f62fd91c9e7e90dd6583d0175
- SHA256
  
  c47a8ccae037883173e0c3c2c3face8d4d5394f7c4492449e9bcfce6d09f5d6e
- SHA512
  
  971559d0b0a01123b2ba7816ca6f7e18c78d34a4a019ddc65cc37c9975c5bc632016ca7298d6a2fb2cedaf1d5aca41e4fabc076eab5ad8c834515249373a468f
- SSDEEP
  
  49152:eMAu1YhEi8/IRIsfr6znwMLTNhNp5WaCTf6yftvJj89NgwQ2mLlVxEB9nrxj76e:eM7EJ6rnLNp5M2BB9Vh
Score

1^/10
behavioral16 behavioral17
- Target
  
  libEGL.dll
- Size
  
  469KB
- MD5
  
  8a5340cb6f4b3f2b994805377e55064a
- SHA1
  
  3467c3ee0f43e7f96067a4214b4a779047b513c8
- SHA256
  
  82d58ee19e2e9e4dbd1538b86826764127bd9c803786e3b0dd7ed8a20db52516
- SHA512
  
  3ba4804fb812e0ef002ed28bc427e9ba9d72d2ef1061c1f740be74f2d14292e40cc0f458cf996e682da9fbf506158cb1771a2b8520f29de08f0fa37762e22008
- SSDEEP
  
  6144:+Kd5lhuD6QUxfHF4HskqTmydxlbGENgMi2nVnIw:+I5vulgfl4Hs1P53Ln3
Score

1^/10
behavioral18 behavioral19
- Target
  
  libGLESv2.dll
- Size
  
  7.1MB
- MD5
  
  7ef231a60b94dc67d845879e53253a9d
- SHA1
  
  6d8d60149e27ef0e2868cc516a2b92bca3aecf28
- SHA256
  
  75c0f506a6dbe0a69baace580625974558f794258dc55d957f1f0ffe48cf7479
- SHA512
  
  7e9d8639221b9049c36723df0098bbfafdd1b4f4b046ee74c24586fc290d2ac0b25152ef857a6bf2619a40e6791abdd62c46e36f5be5326b115c414aef14681a
- SSDEEP
  
  98304:9tiJiCLKLBLAzNftWPaMT12CwV5jBwWGDa:gwQBMbaBNG
Score

1^/10
behavioral20 behavioral21
- Target
  
  resources/app.asar.unpacked/node_modules/rcedit/bin/rcedit-x64.exe
- Size
  
  1.3MB
- MD5
  
  994a67cc8049c603f233ea320f7f540b
- SHA1
  
  43bf856806affdb7b7f7233375c7b95b1d59e974
- SHA256
  
  fae0260b541a3c02b384f464a1c2ff0d1751cd0699bff49e7c545ddd578cccf4
- SHA512
  
  945e32bb9274f96e7fd389c73c8ff2dd3684bdfdc0a6180088a0206447df1ed1f1dee0d3f16b0cda52e8fdc6ae7c8bae500292244bd01763ed2b08a69f18ef1c
- SSDEEP
  
  24576:DEyXNImAx9NyoFP0gP/4C2bO1qIQP/JPlfg/OXnEE:DEydbMyuqIQbfMO0E
Score

1^/10
behavioral22 behavioral23
- Target
  
  resources/app.asar.unpacked/node_modules/rcedit/bin/rcedit.exe
- Size
  
  943KB
- MD5
  
  b8ee03943c2219b37d209c717820e6da
- SHA1
  
  7933ae8b4db0eac844cf5faa90f267a9a58b3a71
- SHA256
  
  38a96b390a880c90f8f20574bdef76cf2bd70fe9719fedecc1f63c12d01b8e05
- SHA512
  
  6f169f7571a74dea9f774cb448f6d00e34da027f2d93fae7114f8ba7a82a24b9f74265bfc9c42ffe3aa5b2aabcafaacf668745edf435073634d2d0f28206686f
- SSDEEP
  
  12288:taKwwMP7EpEzsXMQmgEySArWgH7irNxkDzfRF3sriU8ivsAQm5:taKTk7EpEzsHfBDzzsrj8esAQ
Score

1^/10
behavioral24 behavioral25
- Target
  
  resources/app.asar.unpacked/node_modules/rcedit/lib/rcedit.js
- Size
  
  1KB
- MD5
  
  ac0e80f780218e7bf9094121924684cb
- SHA1
  
  c89c3bc6287d4a6c3cbbd7a1f99e1d642c20f8e8
- SHA256
  
  d63b0d9483bc42af48b0cb3417bc8f91ad0252d40ef6ac7c1db914428d5b4a3e
- SHA512
  
  c5e7ad2296118b501a7bca2d58b641a3ef1869abb48d11f6ff9cbc8febcce1832478bc88c283fb4afcc994868dfacfddf24413187e8689e0813a3a7b3e29c32d
Score

3^/10

execution
behavioral26 behavioral27
- Target
  
  resources/elevate.exe
- Size
  
  114KB
- MD5
  
  bd620b8a4483288821ab8ac18648332e
- SHA1
  
  2e0e5db01c05b6aae6f29268bde59965f50188c7
- SHA256
  
  136b7c8007fe15ed3a5fea4eef4b23256c25a6c685ed67025fb3dc68e775eef9
- SHA512
  
  7258f018aee3b39e130ea14f62a7d6a0f731f68c890cb1631a5e18e641ee989bd13bc48278db6ee0d22e86366b2c5073a88cb946671c43da112db3467367a0bb
- SSDEEP
  
  3072:FAbLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl2LV:OPrwRhte1XsE1l2
Score

1^/10
behavioral28 behavioral29
- Target
  
  vk_swiftshader.dll
- Size
  
  4.9MB
- MD5
  
  9281a9a4a96eaa608ee657de992f5f3d
- SHA1
  
  e663c605ee7c2f79409a784a823e0dc9eebbaa0e
- SHA256
  
  c7ce4bf37998052ee3be6c36ab5a18f2fae1ae0474f3a0d0fbad2382855aeec1
- SHA512
  
  578c1ca8523a94403f6695cf4d201fc036bce75c6dabe63f57ad2b5b1aca8d32ab66ca7df8bdee84a8a7202a539995f5128a448418d07a1589837b53e40013a9
- SSDEEP
  
  49152:4dhIZFC8e/N1dUnfO2fq1LLf4+G4UrRW9yqxV11MXnPr1OTQHaA6XWVzV8Ii66US:44ZFCPFXa5MWU66UeP1WyiWj9
Score

1^/10
behavioral30 behavioral31
- Target
  
  vulkan-1.dll
- Size
  
  917KB
- MD5
  
  e500db5dbb5d6bb83acc3272011c874d
- SHA1
  
  5c2f176831e0376c58d2484334430761b0fc9f4c
- SHA256
  
  538d78238812eb6d6847c26bada47ae38f9c26c035739352273e439d4a78bf94
- SHA512
  
  3d20e206c44771cc6db52a88b9048b54d8afeb5c0b4ad5e64cd7de0c3589fb5326edecc7fad931d15a5e3a07d30733f8891ab7a0555110068eb73f11de5a069e
- SSDEEP
  
  24576:gL99pND/AmS7MzZC+lQv6Z5WoDYsHs6g3P0zAk7Zkk:0pBYmBZ1yv6Z5WoDYsHs6g3P0zAk7ZP
Score

1^/10
behavioral32

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Process Discovery

T1057

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Targets

Detected Egregor ransomware

Egregor Ransomware

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Unexpected DNS network traffic destination

Checks installed software on the system

Looks up external IP address via web service

Checks computer location settings

Loads dropped DLL

Unexpected DNS network traffic destination

Looks up external IP address via web service

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32