Analysis
-
max time kernel
73s -
max time network
140s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
14-05-2022 15:15
Static task
static1
General
-
Target
219e0c4ad265771afcaf6baeb3f0a20b97e455159a2357535c8595e5c9607095.dll
-
Size
532KB
-
MD5
165e54f2df0e74ef1327aa9dc6acf95f
-
SHA1
8ee93c6ecb8a256716c714fb8cf7596098cbdb94
-
SHA256
219e0c4ad265771afcaf6baeb3f0a20b97e455159a2357535c8595e5c9607095
-
SHA512
c1a7e21829ca2608099b72b2dae7cd4132e243d2b12d3d4c6b0d510449502e494276f605260e320545bb76b32defd74a59732908092533d7d354dcccb0554dfd
Malware Config
Signatures
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 2064 regsvr32.exe 2064 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
regsvr32.exepid process 3696 regsvr32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
regsvr32.exedescription pid process target process PID 3696 wrote to memory of 2064 3696 regsvr32.exe regsvr32.exe PID 3696 wrote to memory of 2064 3696 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\219e0c4ad265771afcaf6baeb3f0a20b97e455159a2357535c8595e5c9607095.dll1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\AalTSiCuEee\rlyYIs.dll"2⤵
- Suspicious behavior: EnumeratesProcesses