Analysis
-
max time kernel
72s -
max time network
138s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
14-05-2022 14:59
Static task
static1
General
-
Target
749653acc9eec49e1f1937feb393a386e85bc672e976f2223f79dee148976b7d.dll
-
Size
532KB
-
MD5
60f05a1b53371dc9d04923f9d67af8aa
-
SHA1
732bf1682382be568bfc24162906951b1a83be84
-
SHA256
749653acc9eec49e1f1937feb393a386e85bc672e976f2223f79dee148976b7d
-
SHA512
0a1525ed14e2beb086419eeee8df229605dffc2006c0c695fbbf0cd908ea252f65e5b9a22448746da04ea6d2bdc54c48cbeb6d49bc14593c0d394d174838e1ec
Malware Config
Signatures
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 2072 regsvr32.exe 2072 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
regsvr32.exepid process 3940 regsvr32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
regsvr32.exedescription pid process target process PID 3940 wrote to memory of 2072 3940 regsvr32.exe regsvr32.exe PID 3940 wrote to memory of 2072 3940 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\749653acc9eec49e1f1937feb393a386e85bc672e976f2223f79dee148976b7d.dll1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\QSDpsdH\qjkpwuspwHi.dll"2⤵
- Suspicious behavior: EnumeratesProcesses