Analysis
-
max time kernel
52s -
max time network
142s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
14-05-2022 14:55
Static task
static1
General
-
Target
a98060f715317706a601db804249c0f2eb19fd27da045370dd6ed1679088aab7.dll
-
Size
532KB
-
MD5
940a04b3b9e43651be381023035b1b48
-
SHA1
503488a7168ece4025b9e626bd5f6cbdc97666a4
-
SHA256
a98060f715317706a601db804249c0f2eb19fd27da045370dd6ed1679088aab7
-
SHA512
4a2a1b88e616411473d09a0be01e18845d096ac5be49b1ec05e503dd0fc1865abfcbc5a2e03ff3b336810861942b5266ff39dd253b10cd1f8468497bdc966f6d
Malware Config
Signatures
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 2052 regsvr32.exe 2052 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
regsvr32.exepid process 3788 regsvr32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
regsvr32.exedescription pid process target process PID 3788 wrote to memory of 2052 3788 regsvr32.exe regsvr32.exe PID 3788 wrote to memory of 2052 3788 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\a98060f715317706a601db804249c0f2eb19fd27da045370dd6ed1679088aab7.dll1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\BvHPh\HDSH.dll"2⤵
- Suspicious behavior: EnumeratesProcesses