General
Target

d74de65c8608bf588c0fd01c9e92fdd8bdda4053d655a117aa4ac2f1b7219082.dll

Filesize

532KB

Completed

14-05-2022 14:58

Task

behavioral1

Score
10/10
MD5

3f517537110e23a56ee90633156086b8

SHA1

188433f70c252b6c64d4e17c95cfe297217519f8

SHA256

d74de65c8608bf588c0fd01c9e92fdd8bdda4053d655a117aa4ac2f1b7219082

SHA256

d398270c7b21d7d630959eaea34046bc16e14b7d9b1e47c8dc7cfdb0c5b03f65cbdc2221881637d3ec2bebda63aa1d61157e317b35ddf83b7cca12f15beb245d

Malware Config
Signatures 5

Filter: none

  • Emotet

    Description

    Emotet is a trojan that is primarily spread through spam emails.

  • suricata: ET MALWARE W32/Emotet CnC Beacon 3

    Description

    suricata: ET MALWARE W32/Emotet CnC Beacon 3

    Tags

  • Suspicious behavior: EnumeratesProcesses
    regsvr32.exe

    Reported IOCs

    pidprocess
    360regsvr32.exe
    360regsvr32.exe
  • Suspicious behavior: RenamesItself
    regsvr32.exe

    Reported IOCs

    pidprocess
    804regsvr32.exe
  • Suspicious use of WriteProcessMemory
    regsvr32.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 804 wrote to memory of 360804regsvr32.exeregsvr32.exe
    PID 804 wrote to memory of 360804regsvr32.exeregsvr32.exe
Processes 2
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d74de65c8608bf588c0fd01c9e92fdd8bdda4053d655a117aa4ac2f1b7219082.dll
    Suspicious behavior: RenamesItself
    Suspicious use of WriteProcessMemory
    PID:804
    • C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FHmffmOieM\gytgfzyioRuitTn.dll"
      Suspicious behavior: EnumeratesProcesses
      PID:360
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/360-123-0x0000000000000000-mapping.dmp

                          • memory/804-118-0x0000000180000000-0x0000000180030000-memory.dmp