emotet | 5be2a597f4dd189e582baa743546c71385c1ca8be2e0bf56755c0e08d8deec3e

Analysis

Target
emotet_exe_e5_5be2a597f4dd189e582baa743546c71385c1ca8be2e0bf56755c0e08d8deec3e_2022-01-19__132150.exe.dll
Size 420KB
Sample220119-ql9saaabc8
SHA256 5be2a597f4dd189e582baa743546c71385c1ca8be2e0bf56755c0e08d8deec3e
MD5 35961c1767739e75d864a6ab789e4ddb
SHA1 5d1f78008f287caf55f8db183be4a74bb8c11803
SHA512 7be7ae17fafdefa063eb107534443208d4dab773197e9d978edee0f71e983d294b58d407ca5722b14604eba31de7c79e0fc2767b3c0a77d42ab6d2c76477795c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	2668	svchost.exe
Token: SeSystemtimePrivilege	2668	svchost.exe
Token: SeIncBasePriorityPrivilege	2668	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 3108	2656	regsvr32.exe	51
PID 2656 wrote to memory of 3108	2656	regsvr32.exe	51
PID 2656 wrote to memory of 3108	2656	regsvr32.exe	51
PID 3108 wrote to memory of 1864	3108	regsvr32.exe	57
PID 3108 wrote to memory of 1864	3108	regsvr32.exe	57
PID 3108 wrote to memory of 1864	3108	regsvr32.exe	57

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_5be2a597f4dd189e582baa743546c71385c1ca8be2e0bf56755c0e08d8deec3e_2022-01-19__132150.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_5be2a597f4dd189e582baa743546c71385c1ca8be2e0bf56755c0e08d8deec3e_2022-01-19__132150.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3108
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_5be2a597f4dd189e582baa743546c71385c1ca8be2e0bf56755c0e08d8deec3e_2022-01-19__132150.exe.dll",DllRegisterServer
    3⤵
    PID:1864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2668

memory/3108-133-0x0000000004CD0000-0x0000000004CF8000-memory.dmp

Download