Analysis
-
max time kernel
56s -
max time network
145s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
14-05-2022 15:12
Static task
static1
General
-
Target
bc75be617cf7e8cf1e0a701a4510a1094a3873651123b34907a8165dd3b072e7.dll
-
Size
532KB
-
MD5
8f7a884cfd94fc5743a3e03410a52a48
-
SHA1
c6fecb504e01adbb8c13033cab295a7b4bc834cd
-
SHA256
bc75be617cf7e8cf1e0a701a4510a1094a3873651123b34907a8165dd3b072e7
-
SHA512
6fb22ba7245fcce26ba0e3ab2384c44d65aec72f1ce328aac8f9deca35c5267fcc396a51605a4bfccd6002b52024cc70a2cd6694b0dfb89f34856fd30db79fa2
Malware Config
Signatures
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 2304 regsvr32.exe 2304 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
regsvr32.exepid process 1840 regsvr32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1840 wrote to memory of 2304 1840 regsvr32.exe regsvr32.exe PID 1840 wrote to memory of 2304 1840 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\bc75be617cf7e8cf1e0a701a4510a1094a3873651123b34907a8165dd3b072e7.dll1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\HaoUeAnjsWDq\DdyPxlmCCrbqe.dll"2⤵
- Suspicious behavior: EnumeratesProcesses