Analysis
-
max time kernel
73s -
max time network
134s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
14-05-2022 15:06
Static task
static1
General
-
Target
4fef4af097a84e95f901d3b35dc5638a1e50f432cb758165c70aab89b81d0fc8.dll
-
Size
532KB
-
MD5
1e34e15df8ba31aa5c06e38d65476011
-
SHA1
a44104314277e58a3f2bc281a744302bb4742bc0
-
SHA256
4fef4af097a84e95f901d3b35dc5638a1e50f432cb758165c70aab89b81d0fc8
-
SHA512
02fe2e5aee33e44e1fd89998d5c172de7c4a6971e2c1d9aaa89d3208147440d5e49f78275624ab0bc1c6ae3bd768e6c45dbced5dadc8fffabdf7af37f1a8c406
Malware Config
Signatures
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 4404 regsvr32.exe 4404 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
regsvr32.exepid process 4692 regsvr32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
regsvr32.exedescription pid process target process PID 4692 wrote to memory of 4404 4692 regsvr32.exe regsvr32.exe PID 4692 wrote to memory of 4404 4692 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\4fef4af097a84e95f901d3b35dc5638a1e50f432cb758165c70aab89b81d0fc8.dll1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\OwxWAbmgnd\wDPtHUiYNiLzJ.dll"2⤵
- Suspicious behavior: EnumeratesProcesses