emotet | d17d7b705efbd7090134812349d1078ccfbad9a40e99d4ac4de4ed64182ac634

Analysis

Target
emotet_exe_e5_d17d7b705efbd7090134812349d1078ccfbad9a40e99d4ac4de4ed64182ac634_2022-01-19__000912.exe.dll
Size 408KB
Sample220119-af59xaebgk
SHA256 d17d7b705efbd7090134812349d1078ccfbad9a40e99d4ac4de4ed64182ac634
MD5 736f991e638ea3026543b80b6f296ed6
SHA1 b3447a9346c6519412d1f59e8601e04dcd094f0a
SHA512 8c01197c2df35cdf13523e745f09fb4595ad29de85f8f639ff04608a9aafd7c15eb7e4a858cb99c2484ef6be1cda992b1565b036b68885890cb4f833dd8db260
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	3288	svchost.exe
Token: SeSystemtimePrivilege	3288	svchost.exe
Token: SeIncBasePriorityPrivilege	3288	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 3484	2188	regsvr32.exe	51
PID 2188 wrote to memory of 3484	2188	regsvr32.exe	51
PID 2188 wrote to memory of 3484	2188	regsvr32.exe	51
PID 3484 wrote to memory of 3856	3484	regsvr32.exe	52
PID 3484 wrote to memory of 3856	3484	regsvr32.exe	52
PID 3484 wrote to memory of 3856	3484	regsvr32.exe	52

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_d17d7b705efbd7090134812349d1078ccfbad9a40e99d4ac4de4ed64182ac634_2022-01-19__000912.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_d17d7b705efbd7090134812349d1078ccfbad9a40e99d4ac4de4ed64182ac634_2022-01-19__000912.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3484
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_d17d7b705efbd7090134812349d1078ccfbad9a40e99d4ac4de4ed64182ac634_2022-01-19__000912.exe.dll",DllRegisterServer
    3⤵
    PID:3856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3288

memory/3484-130-0x0000000002EA0000-0x0000000002EC8000-memory.dmp

Download