Analysis

  • max time kernel
    61s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/11/2022, 09:19

General

  • Target

    fdd19b6d587faddc0528f2775f2f4cde.dll

  • Size

    814KB

  • MD5

    fdd19b6d587faddc0528f2775f2f4cde

  • SHA1

    aca2a0b39e9c9f8a0452bd8435688464b9edb6a1

  • SHA256

    4b5655b8e09db82a8a00404fbd12044fc9fe640c6ee75953099e93fc8fb3e2db

  • SHA512

    142c32bc34c8163b1c4a58c0af57da4573b8197f3504696a04daa353d9d7384fd66f48c892da100f218e67bfe23cfc4da11d22898e1a4182e72b4b3e47a5ba43

  • SSDEEP

    12288:5sIyzbpudwh9PQx873eHeLs15pZ6yRQNf04Tn/WMideaik:5JyzbwdG4eLsjpZfRQN/q8fk

Malware Config

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fdd19b6d587faddc0528f2775f2f4cde.dll
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:4712
    • C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MivZycOWLW\IJRYh.dll"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:1648

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4712-132-0x0000000180000000-0x000000018002F000-memory.dmp

    Filesize

    188KB