Analysis
-
max time kernel
92s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
14-05-2022 01:56
Static task
static1
Behavioral task
behavioral1
Sample
69952fafa4ad582439ef0a1fbed1f6ff.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
69952fafa4ad582439ef0a1fbed1f6ff.dll
-
Size
532KB
-
MD5
69952fafa4ad582439ef0a1fbed1f6ff
-
SHA1
496210b0b66937e547783ac8787eaf061b1c34fe
-
SHA256
913db6d757a6f498a23cb1bbe7f8aa7f622bac41e86e52b698c9139be59fafc1
-
SHA512
5e68681ba497cabf74080b784ad4cbed9d076938009d982897c0a5ff512a0eae6cba2df1b91667e27b2186fa45977983d68795b9a62d88d903b5a10057cfa5a4
Malware Config
Signatures
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 2188 regsvr32.exe 2188 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
regsvr32.exepid process 4472 regsvr32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
regsvr32.exedescription pid process target process PID 4472 wrote to memory of 2188 4472 regsvr32.exe regsvr32.exe PID 4472 wrote to memory of 2188 4472 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\69952fafa4ad582439ef0a1fbed1f6ff.dll1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\OJhZIcTsgGNlCMH\kxms.dll"2⤵
- Suspicious behavior: EnumeratesProcesses