emotet | 8f491e695ad6d9696c02650ca1ac25448d5123897682b2cfa3c9fae7c6075cf2

Analysis

Target
emotet_exe_e4_8f491e695ad6d9696c02650ca1ac25448d5123897682b2cfa3c9fae7c6075cf2_2022-01-19__123037.exe.dll
Size 408KB
Sample220119-pp2qeahfhq
SHA256 8f491e695ad6d9696c02650ca1ac25448d5123897682b2cfa3c9fae7c6075cf2
MD5 d389ecd2e845cec4658a843fc6fb7cec
SHA1 bb805ea17a1de9ece19d341ebe66978e2cd9e1d9
SHA512 1da6a019da83bb211c8576fe0532f708b564c6a22d79b55832e58fa76b16826631d406f058f497817ff11bf1d456233a0a51f555becbb772480e6fa4c619b964
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	3860	svchost.exe
Token: SeSystemtimePrivilege	3860	svchost.exe
Token: SeIncBasePriorityPrivilege	3860	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 2188	3368	regsvr32.exe	51
PID 3368 wrote to memory of 2188	3368	regsvr32.exe	51
PID 3368 wrote to memory of 2188	3368	regsvr32.exe	51
PID 2188 wrote to memory of 3852	2188	regsvr32.exe	52
PID 2188 wrote to memory of 3852	2188	regsvr32.exe	52
PID 2188 wrote to memory of 3852	2188	regsvr32.exe	52

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_8f491e695ad6d9696c02650ca1ac25448d5123897682b2cfa3c9fae7c6075cf2_2022-01-19__123037.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_8f491e695ad6d9696c02650ca1ac25448d5123897682b2cfa3c9fae7c6075cf2_2022-01-19__123037.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_8f491e695ad6d9696c02650ca1ac25448d5123897682b2cfa3c9fae7c6075cf2_2022-01-19__123037.exe.dll",DllRegisterServer
    3⤵
    PID:3852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3860

memory/2188-130-0x00000000032F0000-0x0000000003316000-memory.dmp

Download