Analysis
-
max time kernel
50s -
max time network
144s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
14-05-2022 14:49
Static task
static1
General
-
Target
f60221b35bce79d8e153e46ea6edccc8def989e0a3a4c8d6630c1135e4995bfb.dll
-
Size
538KB
-
MD5
201a504428834db74da6b47dd4f501d1
-
SHA1
1f1fe3a6f12cbf328d785ca36dc53edd2396c988
-
SHA256
f60221b35bce79d8e153e46ea6edccc8def989e0a3a4c8d6630c1135e4995bfb
-
SHA512
b9b689ecad395e60f6a89bed03274efe1c8aa7484ba61c94b1f1044bd395be4903b7f47a714b50950662083490cc9467077f9e8fa80d19ff0d6b9c85090bdd8d
Malware Config
Signatures
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 2368 regsvr32.exe 2368 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
regsvr32.exepid process 4568 regsvr32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
regsvr32.exedescription pid process target process PID 4568 wrote to memory of 2368 4568 regsvr32.exe regsvr32.exe PID 4568 wrote to memory of 2368 4568 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\f60221b35bce79d8e153e46ea6edccc8def989e0a3a4c8d6630c1135e4995bfb.dll1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\JyGmlvWKkPwh\NBUrhPjzhPovUFb.dll"2⤵
- Suspicious behavior: EnumeratesProcesses