Analysis
-
max time kernel
94s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 09:17
Behavioral task
behavioral1
Sample
emotet.dll
Resource
win7-20230220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
emotet.dll
Resource
win10v2004-20230220-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
emotet.dll
-
Size
360KB
-
MD5
07e1fcd7c2bd9805e2c33e83393b7298
-
SHA1
8a43110b792151ae857122f8425666fc8ac55aaf
-
SHA256
64e86483c5fa5ac252a6bf087b44085a4d536b184e0ee95d79617ad1e4505e49
-
SHA512
5fa9843215c04b4339a7dfa94ab6fa583b4535de231e09e915c36ceebca8627610dd6a7d8e13c72030618f6779301d43436d18bdc47fc6696d34ffc47a2e8dab
-
SSDEEP
6144:BX1K0hROWQHfYtH4ve6REwSBPuuOVN7Oc5jthTq5wzDigKa:F1KMEWQHfaYveI6OT7x/1Digb
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\coxDOaGFJyzFa.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\MczMhf\\coxDOaGFJyzFa.dll\"" regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
regsvr32.exeregsvr32.exepid process 1280 regsvr32.exe 1280 regsvr32.exe 720 regsvr32.exe 720 regsvr32.exe 720 regsvr32.exe 720 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
regsvr32.exepid process 1280 regsvr32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1280 wrote to memory of 720 1280 regsvr32.exe regsvr32.exe PID 1280 wrote to memory of 720 1280 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet.dll1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\MczMhf\coxDOaGFJyzFa.dll"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses