Analysis
-
max time kernel
52s -
max time network
136s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
14-05-2022 15:15
Static task
static1
General
-
Target
572182b2482c90f58a8a21fc39aaa37481e3bb3170e5186e39c0533ad2edbeb3.dll
-
Size
532KB
-
MD5
e3479688778103b1dfca0f590319a002
-
SHA1
f93604f478a10f8a233fe90e7996cf0c040ba467
-
SHA256
572182b2482c90f58a8a21fc39aaa37481e3bb3170e5186e39c0533ad2edbeb3
-
SHA512
5f7724f6839b3ec3a27d34a77efd208d942f31b44641ad0cda1b0a8d651d6595c0bd9930fa0b74d3786ab09299fea27ac533a8789f5b91ae0c6645f3b4ef3434
Malware Config
Signatures
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 1392 regsvr32.exe 1392 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
regsvr32.exepid process 3932 regsvr32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
regsvr32.exedescription pid process target process PID 3932 wrote to memory of 1392 3932 regsvr32.exe regsvr32.exe PID 3932 wrote to memory of 1392 3932 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\572182b2482c90f58a8a21fc39aaa37481e3bb3170e5186e39c0533ad2edbeb3.dll1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\MLaSlGBFDetRZvgk\KfDZl.dll"2⤵
- Suspicious behavior: EnumeratesProcesses