Analysis
-
max time kernel
57s -
max time network
143s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
14-05-2022 14:28
Static task
static1
General
-
Target
8dfd708f85c92e3f9a71a133f1df5ccd03054be7e6739934293d7e498bd3134f.dll
-
Size
538KB
-
MD5
91b961bed53a89a6a86fd4580ad164fe
-
SHA1
581b3b7674d7dc311913f9431b01b4422143a9d4
-
SHA256
8dfd708f85c92e3f9a71a133f1df5ccd03054be7e6739934293d7e498bd3134f
-
SHA512
dcb631deac6dc527c79234b932ed08f91fda3a2f63743e67627165f7a7f8a6bd9f755b40be4a1ccd9fe249dc073859f6327df86ec1cec4a33574fcae8c04ccf9
Malware Config
Signatures
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 4716 regsvr32.exe 4716 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
regsvr32.exepid process 4692 regsvr32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
regsvr32.exedescription pid process target process PID 4692 wrote to memory of 4716 4692 regsvr32.exe regsvr32.exe PID 4692 wrote to memory of 4716 4692 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\8dfd708f85c92e3f9a71a133f1df5ccd03054be7e6739934293d7e498bd3134f.dll1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\UODezSlcDtzMQH\ibzXTlFp.dll"2⤵
- Suspicious behavior: EnumeratesProcesses