cd40018feae68dd7dec23dd581d66ad9003ebc893da67568e1b915dda8ac6319 | Triage

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
02-04-2023 04:42

Sharing

Report Analysis Logs

General

Target

unpacked_emotet64.dll
Size

176KB
MD5

236ae63e2ac25b35edbceca4443bd95f
SHA1

afeec39579338258887978acb89ef48cd3d9bbf4
SHA256

cd40018feae68dd7dec23dd581d66ad9003ebc893da67568e1b915dda8ac6319
SHA512

854b134740de9ee7c1cec59163ec09ad6b03bb537af718c069a9ece68b364bf1cc8a827975a4cf596d233347af1f60c06f6bbb8de4cbb56c83ebeda06ebf6629
SSDEEP

3072:OCS65TUo7WInfB2A5MNJgEqVw7UPej+1Ae7swyo8sTYBA:bJ5TUoznfUbgEqCI1lcsTYy

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

3372 regsvr32.exe
3372 regsvr32.exe
2296 regsvr32.exe
2296 regsvr32.exe
2296 regsvr32.exe
2296 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

3372 regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3372 wrote to memory of 2296	3372	regsvr32.exe	regsvr32.exe
PID 3372 wrote to memory of 2296	3372	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\unpacked_emotet64.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3372

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\CJBXX\mHNxWaWFJCedKI.dll"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2296

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...