Analysis
-
max time kernel
108s -
max time network
139s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
14-05-2022 14:38
Static task
static1
General
-
Target
6fda6003a206c51830336043ed1eb35ddaf5b83382693966c7c83fccd4b5a3fd.dll
-
Size
532KB
-
MD5
051dda521a5fd2c117187bc23bfc8a9f
-
SHA1
3a7805b51ec38f4e04daf1f90c164fbe5c281711
-
SHA256
6fda6003a206c51830336043ed1eb35ddaf5b83382693966c7c83fccd4b5a3fd
-
SHA512
6a9bcd3109e48a0c6e9514ad51e4d897d3f6331916587235d5ba85242907ccbde5fb2a95d64a954303af05e239e920a14c691555411ebc70b638864712b91909
Malware Config
Signatures
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 3332 regsvr32.exe 3332 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
regsvr32.exepid process 2192 regsvr32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
regsvr32.exedescription pid process target process PID 2192 wrote to memory of 3332 2192 regsvr32.exe regsvr32.exe PID 2192 wrote to memory of 3332 2192 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\6fda6003a206c51830336043ed1eb35ddaf5b83382693966c7c83fccd4b5a3fd.dll1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\EZDWlrwk\bugzfwlUFSwMDr.dll"2⤵
- Suspicious behavior: EnumeratesProcesses