Analysis
-
max time kernel
83s -
max time network
139s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
14-05-2022 14:28
Static task
static1
General
-
Target
3d89b46eb4d56c143a49e9f77f91d33d38e10c831b2ceaa5a98651e4881fbe8e.dll
-
Size
532KB
-
MD5
e076dbbe033ab31887afd597cc71b600
-
SHA1
42f8ab6a378c20fff3e7b1d29f4c524b3827a62c
-
SHA256
3d89b46eb4d56c143a49e9f77f91d33d38e10c831b2ceaa5a98651e4881fbe8e
-
SHA512
a5d234ff4642c2431dea5ce9d7bda1e555324f13cb838d3f3f849844ae372d9f001f3238f4f2351f9dd1a822d422112e09ef9062d414be31e8111152341ed63a
Malware Config
Signatures
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 2712 regsvr32.exe 2712 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
regsvr32.exepid process 2372 regsvr32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
regsvr32.exedescription pid process target process PID 2372 wrote to memory of 2712 2372 regsvr32.exe regsvr32.exe PID 2372 wrote to memory of 2712 2372 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\3d89b46eb4d56c143a49e9f77f91d33d38e10c831b2ceaa5a98651e4881fbe8e.dll1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\YxYLEsu\WGnXkf.dll"2⤵
- Suspicious behavior: EnumeratesProcesses