debad0131060d5dd9c4642bd6aed186c4a57b46b0f4c69f1af16b1ff9c0a77b1 | Triage

Analysis

max time kernel
40s
max time network
148s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
02-04-2023 04:31

Sharing

Report Analysis Logs

General

Target

test_unpacked_emotet.dll
Size

161KB
MD5

a8c3f116cf9c9f7fd1cb8d5a96fc747d
SHA1

ca184c5385c9833f7ee97cd6f4af70b7404a5d76
SHA256

debad0131060d5dd9c4642bd6aed186c4a57b46b0f4c69f1af16b1ff9c0a77b1
SHA512

cf57b647cc5ce3546da0bbc42015910ae837494e0060834b85c51fc8b2c3690c9c36e757abb94095b2dda4d36337743a10552f6a7b7cbe2dfc14a3dbd5f843f5
SSDEEP

3072:R6bDR4tUro+opTdespdfXfnZo1eJhh4QnwnyJJGv:KcsUeSt/Zo1eJh+WG

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1476 regsvr32.exe
920 regsvr32.exe
920 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

1476 regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1476 wrote to memory of 920	1476	regsvr32.exe	regsvr32.exe
PID 1476 wrote to memory of 920	1476	regsvr32.exe	regsvr32.exe
PID 1476 wrote to memory of 920	1476	regsvr32.exe	regsvr32.exe
PID 1476 wrote to memory of 920	1476	regsvr32.exe	regsvr32.exe
PID 1476 wrote to memory of 920	1476	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\test_unpacked_emotet.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1476

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\EQOplJx\lpzdrlvsgVik.dll"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...