Analysis
-
max time kernel
102s -
max time network
114s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
14-05-2022 13:52
Static task
static1
General
-
Target
da82635251e76a1ea152aafc0014a569f6731941e0c4709b2cabcf1d92fc13dd.dll
-
Size
532KB
-
MD5
38f63e9c4a2e0d86d1057393842f9d4b
-
SHA1
a9a74472d40407c028d0617f657fbaa6a18228e8
-
SHA256
da82635251e76a1ea152aafc0014a569f6731941e0c4709b2cabcf1d92fc13dd
-
SHA512
e54f2f543dc46aee7344101795185936189feb5e5fb82447ad452acb55df5f59291e6b98c0511d1adc9025a39994f2a30c390fce114b84fc3cf790cb0e1ceb3e
Malware Config
Signatures
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 4072 regsvr32.exe 4072 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
regsvr32.exepid process 1040 regsvr32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1040 wrote to memory of 4072 1040 regsvr32.exe regsvr32.exe PID 1040 wrote to memory of 4072 1040 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\da82635251e76a1ea152aafc0014a569f6731941e0c4709b2cabcf1d92fc13dd.dll1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\MOxoGiD\fkAaWT.dll"2⤵
- Suspicious behavior: EnumeratesProcesses