Analysis
-
max time kernel
108s -
max time network
136s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
14-05-2022 14:18
Static task
static1
General
-
Target
fea90afd9ba8022f2ea21af59db47e95473291a3950d6449739bff9f48e2f3a0.dll
-
Size
532KB
-
MD5
b661cb20554934ef75de6938d1dc4ff1
-
SHA1
0caf3cf031e1140335d13472c8f4c22a931c10e5
-
SHA256
fea90afd9ba8022f2ea21af59db47e95473291a3950d6449739bff9f48e2f3a0
-
SHA512
182ec5d7b5929f3d5cc7dfcb46cec1799532206ca455ba64ebbcad1a0aa6ac5da05e190d20e0f31f234c78636bbe086b5482eb64450f926221938112446b968f
Malware Config
Signatures
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 3332 regsvr32.exe 3332 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
regsvr32.exepid process 2192 regsvr32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
regsvr32.exedescription pid process target process PID 2192 wrote to memory of 3332 2192 regsvr32.exe regsvr32.exe PID 2192 wrote to memory of 3332 2192 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\fea90afd9ba8022f2ea21af59db47e95473291a3950d6449739bff9f48e2f3a0.dll1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\JWaimkRFDgdpg\TFiaZ.dll"2⤵
- Suspicious behavior: EnumeratesProcesses