c6352bc272cd568c6b65472d25d77588556b0aa40d49e1ce1b94f41b9caa3f83

General
Target

c6352bc272cd568c6b65472d25d77588556b0aa40d49e1ce1b94f41b9caa3f83.dll

Filesize

538KB

Completed

14-05-2022 14:30

Score
10/10
MD5

973bf8dc2f231a25daa85ab84112b81a

SHA1

9e9823eda5595509e7b3d77a73d18c90d1292356

SHA256

c6352bc272cd568c6b65472d25d77588556b0aa40d49e1ce1b94f41b9caa3f83

Malware Config
Signatures 5

Filter: none

  • Emotet

    Description

    Emotet is a trojan that is primarily spread through spam emails.

    Tags

  • suricata: ET MALWARE W32/Emotet CnC Beacon 3

    Description

    suricata: ET MALWARE W32/Emotet CnC Beacon 3

    Tags

  • Suspicious behavior: EnumeratesProcesses
    regsvr32.exe

    Reported IOCs

    pidprocess
    628regsvr32.exe
    628regsvr32.exe
  • Suspicious behavior: RenamesItself
    regsvr32.exe

    Reported IOCs

    pidprocess
    2700regsvr32.exe
  • Suspicious use of WriteProcessMemory
    regsvr32.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 2700 wrote to memory of 6282700regsvr32.exeregsvr32.exe
    PID 2700 wrote to memory of 6282700regsvr32.exeregsvr32.exe
Processes 2
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c6352bc272cd568c6b65472d25d77588556b0aa40d49e1ce1b94f41b9caa3f83.dll
    Suspicious behavior: RenamesItself
    Suspicious use of WriteProcessMemory
    PID:2700
    • C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe "C:\Windows\system32\KZOChrmjV\CdxuFqOcbnSckf.dll"
      Suspicious behavior: EnumeratesProcesses
      PID:628
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads

                          • memory/628-124-0x0000000000000000-mapping.dmp

                            Download

                          • memory/2700-119-0x0000000180000000-0x0000000180032000-memory.dmp

                            Download