Analysis
-
max time kernel
51s -
max time network
140s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
14-05-2022 14:19
Static task
static1
General
-
Target
4aedd3231b227e33177a6c70a596e501983110f4bb0bc21f43345068089c14f9.dll
-
Size
538KB
-
MD5
e50894e92c75e4ce2e34ecca965df7ca
-
SHA1
028ecd15c3db2f39d0fe933fc00fb9733900744d
-
SHA256
4aedd3231b227e33177a6c70a596e501983110f4bb0bc21f43345068089c14f9
-
SHA512
6019793222df298acc67e019c53e6d3628f69b36a44c218d080cc3851f57859f8f31aa456958a5dae602e93be8077a7525abf7d43c1b163ac553b717335e4f40
Malware Config
Signatures
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 4552 regsvr32.exe 4552 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
regsvr32.exepid process 4020 regsvr32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
regsvr32.exedescription pid process target process PID 4020 wrote to memory of 4552 4020 regsvr32.exe regsvr32.exe PID 4020 wrote to memory of 4552 4020 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\4aedd3231b227e33177a6c70a596e501983110f4bb0bc21f43345068089c14f9.dll1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\BSlKMCKYJlzTYy\QEYEcYpHVD.dll"2⤵
- Suspicious behavior: EnumeratesProcesses