Analysis
-
max time kernel
52s -
max time network
141s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
14-05-2022 14:11
Static task
static1
General
-
Target
7025310135a3ece876e1f63f9df7eaac02775f3fd20a69ec33b994627832c589.dll
-
Size
538KB
-
MD5
79568d7621b2fc2b97c5a8c7ef6f4321
-
SHA1
0dbb71907f2fa5daeba4032115f00b6b9229f3da
-
SHA256
7025310135a3ece876e1f63f9df7eaac02775f3fd20a69ec33b994627832c589
-
SHA512
ab13f3b5ad7ae3d2c748eafc9e0cd0934c2b7fa916d768358a715be67f92a48c3acb272cbafc9b9f1a9e89912c56f49941adcdf0bfbc532a07d9ca70fffea192
Malware Config
Signatures
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 2720 regsvr32.exe 2720 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
regsvr32.exepid process 2348 regsvr32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
regsvr32.exedescription pid process target process PID 2348 wrote to memory of 2720 2348 regsvr32.exe regsvr32.exe PID 2348 wrote to memory of 2720 2348 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\7025310135a3ece876e1f63f9df7eaac02775f3fd20a69ec33b994627832c589.dll1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\MtPKzYNvAzyX\PpVwSKrInHXtw.dll"2⤵
- Suspicious behavior: EnumeratesProcesses