Analysis
-
max time kernel
51s -
max time network
139s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
14-05-2022 15:15
Static task
static1
General
-
Target
d9f0c7fd648a1efe1ef5006b966f5c533aac0c25bdaaf5f51d03eca163963aa5.dll
-
Size
532KB
-
MD5
8243508a9eb46acffb476856dc91d2a6
-
SHA1
82ba7457ebcbf9867389e0dc6397d99d1b4d4e85
-
SHA256
d9f0c7fd648a1efe1ef5006b966f5c533aac0c25bdaaf5f51d03eca163963aa5
-
SHA512
1f993dc0741458ac081f6a0501b29ccee2d9b474c548cb07a2265190a4eedac43899fdef9c6ab6b6c2c38dc802e802f4ebaf7cdae6b86847b6b4ce4b0e091d95
Malware Config
Signatures
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 1736 regsvr32.exe 1736 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
regsvr32.exepid process 4468 regsvr32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
regsvr32.exedescription pid process target process PID 4468 wrote to memory of 1736 4468 regsvr32.exe regsvr32.exe PID 4468 wrote to memory of 1736 4468 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\d9f0c7fd648a1efe1ef5006b966f5c533aac0c25bdaaf5f51d03eca163963aa5.dll1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\YFXnsphIdTzEL\KgyIfGKxwt.dll"2⤵
- Suspicious behavior: EnumeratesProcesses