Analysis
-
max time kernel
53s -
max time network
139s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
14-05-2022 14:27
Static task
static1
General
-
Target
8997ef91b7271ff02d95c68c8101d5b3008bc3da527bfe1d7dd03d425963b7c7.dll
-
Size
532KB
-
MD5
c79f3ea07d1c5621e5c52ae41ce2838f
-
SHA1
6f838ad4285ec3f494285b475dc344f348c1d7fe
-
SHA256
8997ef91b7271ff02d95c68c8101d5b3008bc3da527bfe1d7dd03d425963b7c7
-
SHA512
11bde3806df72ce1bb270be278ad4a37e668fbfed207222631d22fab56cd0cb4b736682de9365505298f52369844fcfd70572a0b801a7af89e67bc095593c37b
Malware Config
Signatures
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 2380 regsvr32.exe 2380 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
regsvr32.exepid process 1924 regsvr32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1924 wrote to memory of 2380 1924 regsvr32.exe regsvr32.exe PID 1924 wrote to memory of 2380 1924 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\8997ef91b7271ff02d95c68c8101d5b3008bc3da527bfe1d7dd03d425963b7c7.dll1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\DHrzR\PrNrwQPBXOOkQ.dll"2⤵
- Suspicious behavior: EnumeratesProcesses