Analysis
-
max time kernel
139s -
max time network
141s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
14-05-2022 15:06
Static task
static1
General
-
Target
f5415e702a025755bd0b52734ed96e96336fefe184002e8ff6422de64cb85bc2.dll
-
Size
532KB
-
MD5
72d94a9545672168b08fa6e30aceff88
-
SHA1
f034a8163f2c6b56346982172458307bacfa696b
-
SHA256
f5415e702a025755bd0b52734ed96e96336fefe184002e8ff6422de64cb85bc2
-
SHA512
de9b0c5a38ca7859e50f965e24ea39f15aeaad30773a9aeab8e35f4f8046303e626e390929e112913da6ede00c6896977943f5a6cb16ec912858ec932a2adfbf
Malware Config
Signatures
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 2972 regsvr32.exe 2972 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
regsvr32.exepid process 3092 regsvr32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
regsvr32.exedescription pid process target process PID 3092 wrote to memory of 2972 3092 regsvr32.exe regsvr32.exe PID 3092 wrote to memory of 2972 3092 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\f5415e702a025755bd0b52734ed96e96336fefe184002e8ff6422de64cb85bc2.dll1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\EDJlIRAGrxKBZA\bGNwsqtSAb.dll"2⤵
- Suspicious behavior: EnumeratesProcesses