Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
14-05-2022 15:21
Static task
static1
General
-
Target
4f0b41bcc7b09b762ea0c62c6b7bd016b39d9a91d86617131a917eeec5f5c69c.dll
-
Size
538KB
-
MD5
b4967f2541afc0c93ecbce756be9a670
-
SHA1
e1792e5b05ba7b503454699f0433490c42d984ee
-
SHA256
4f0b41bcc7b09b762ea0c62c6b7bd016b39d9a91d86617131a917eeec5f5c69c
-
SHA512
e6ab3d69404f2a9255e982e2995aa8e8100241c4be479aeb1ecd06d03930844195de557adfca39eb42b2b43c59a9032aeefacfed055e6f6a10c3f3ccd0b7d8c7
Malware Config
Signatures
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 2084 regsvr32.exe 2084 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
regsvr32.exepid process 424 regsvr32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
regsvr32.exedescription pid process target process PID 424 wrote to memory of 2084 424 regsvr32.exe regsvr32.exe PID 424 wrote to memory of 2084 424 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\4f0b41bcc7b09b762ea0c62c6b7bd016b39d9a91d86617131a917eeec5f5c69c.dll1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\RhJbgKO\rcSzTRHLSVOFM.dll"2⤵
- Suspicious behavior: EnumeratesProcesses