Analysis
-
max time kernel
55s -
max time network
143s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
14-05-2022 15:15
Static task
static1
General
-
Target
92a73949d8c8588e39103a561012aff8147493b43bd25e84c388c08912eb707f.dll
-
Size
532KB
-
MD5
fd1894e717e6f7b7df2b45a03386e8c3
-
SHA1
7f77b9306425ce416ba421c63888c01213154b28
-
SHA256
92a73949d8c8588e39103a561012aff8147493b43bd25e84c388c08912eb707f
-
SHA512
6184c4e7038e8fbdab3a0d2b79a42188a911071c5448347e55d8632baabf7019c3023d5fdb53ae3c63b38fa99e149185879feec8aa64fa4fb7786032ffdcc569
Malware Config
Signatures
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 392 regsvr32.exe 392 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
regsvr32.exepid process 3176 regsvr32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
regsvr32.exedescription pid process target process PID 3176 wrote to memory of 392 3176 regsvr32.exe regsvr32.exe PID 3176 wrote to memory of 392 3176 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\92a73949d8c8588e39103a561012aff8147493b43bd25e84c388c08912eb707f.dll1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\TdqgaJ\FQRerAunnTaZ.dll"2⤵
- Suspicious behavior: EnumeratesProcesses