Analysis
-
max time kernel
54s -
max time network
141s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
14-05-2022 14:35
Static task
static1
General
-
Target
247da7a92e4efe5d8b853b103f81ec0842e6794a1be403871a48f6c285b13ae0.dll
-
Size
532KB
-
MD5
e221e631f44009ca98f7af3209e33bb8
-
SHA1
1805a5b414ae1809f0ae32ab5a55b19488c0cc9f
-
SHA256
247da7a92e4efe5d8b853b103f81ec0842e6794a1be403871a48f6c285b13ae0
-
SHA512
dd6a2ca6a50d7b37c743a5fad19a8b89443afcef733040ff5e69b86da431b96b4f383e99396a5b1fd07cc0a77b6b90652ce3f1934cdcade0d2719a3d981876ca
Malware Config
Signatures
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 2196 regsvr32.exe 2196 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
regsvr32.exepid process 3192 regsvr32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
regsvr32.exedescription pid process target process PID 3192 wrote to memory of 2196 3192 regsvr32.exe regsvr32.exe PID 3192 wrote to memory of 2196 3192 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\247da7a92e4efe5d8b853b103f81ec0842e6794a1be403871a48f6c285b13ae0.dll1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\UAxyKrcZXkb\ntnItWUSPONnnWR.dll"2⤵
- Suspicious behavior: EnumeratesProcesses