General
Target

858cdaba305db3cc97dca8b69417b52c6220cd776b880a245c773ba4c4a2a08e.dll

Filesize

532KB

Completed

14-05-2022 14:51

Task

behavioral1

Score
10/10
MD5

d230f542c29f864bf2ed2bbf9fc78193

SHA1

da5e86d084c327e67820be1b93320cbd25e07d40

SHA256

858cdaba305db3cc97dca8b69417b52c6220cd776b880a245c773ba4c4a2a08e

SHA256

e6d2f91a573e1273c4a69d0d35acda3d564d46cda874d338db25d393d97a745bcef6e7e94f9dde71f82fdf533a888a6dc3b65ec82c1b8288765cd572c331e08b

Malware Config
Signatures 5

Filter: none

  • Emotet

    Description

    Emotet is a trojan that is primarily spread through spam emails.

  • suricata: ET MALWARE W32/Emotet CnC Beacon 3

    Description

    suricata: ET MALWARE W32/Emotet CnC Beacon 3

    Tags

  • Suspicious behavior: EnumeratesProcesses
    regsvr32.exe

    Reported IOCs

    pidprocess
    2064regsvr32.exe
    2064regsvr32.exe
  • Suspicious behavior: RenamesItself
    regsvr32.exe

    Reported IOCs

    pidprocess
    3696regsvr32.exe
  • Suspicious use of WriteProcessMemory
    regsvr32.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 3696 wrote to memory of 20643696regsvr32.exeregsvr32.exe
    PID 3696 wrote to memory of 20643696regsvr32.exeregsvr32.exe
Processes 2
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\858cdaba305db3cc97dca8b69417b52c6220cd776b880a245c773ba4c4a2a08e.dll
    Suspicious behavior: RenamesItself
    Suspicious use of WriteProcessMemory
    PID:3696
    • C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe "C:\Windows\system32\JtSYnqWoFBQXxMRf\OpHqCS.dll"
      Suspicious behavior: EnumeratesProcesses
      PID:2064
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/2064-124-0x0000000000000000-mapping.dmp

                          • memory/3696-119-0x0000000180000000-0x0000000180030000-memory.dmp