Analysis
-
max time kernel
50s -
max time network
147s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
14-05-2022 14:23
Static task
static1
General
-
Target
9c68c3b734d2ff620cf9f953743fc835f5cba74e1aebd61ef361cdaca2b98d49.dll
-
Size
532KB
-
MD5
8ad66e99abaaf9b32d4ae76b81fc6d6f
-
SHA1
0046f401952f88e96dc7af78a51ca8f8868fd35a
-
SHA256
9c68c3b734d2ff620cf9f953743fc835f5cba74e1aebd61ef361cdaca2b98d49
-
SHA512
1bfafcd37522c9b55983c3f744c4143ac1de0ad686a8f13e9e823d12de6c6bae4589a71cb2bbf9e62fb0c54243417f504da3b26912d10a1a212da4a6603ebadb
Malware Config
Signatures
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 2808 regsvr32.exe 2808 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
regsvr32.exepid process 2484 regsvr32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
regsvr32.exedescription pid process target process PID 2484 wrote to memory of 2808 2484 regsvr32.exe regsvr32.exe PID 2484 wrote to memory of 2808 2484 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\9c68c3b734d2ff620cf9f953743fc835f5cba74e1aebd61ef361cdaca2b98d49.dll1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\VaXikRScGSd\rvuo.dll"2⤵
- Suspicious behavior: EnumeratesProcesses