emotet | b5e4b36567ff949fd81a2d44063dd59b45309986aae3e7d57a0c71bc4a4fb74a

Analysis

Target
emotet_exe_e5_b5e4b36567ff949fd81a2d44063dd59b45309986aae3e7d57a0c71bc4a4fb74a_2022-01-19__132149.exe.dll
Size 420KB
Sample220119-ql9saaabdk
SHA256 b5e4b36567ff949fd81a2d44063dd59b45309986aae3e7d57a0c71bc4a4fb74a
MD5 e73f5b2480793d929553eccd7bdac808
SHA1 e6fb350917f6a32a80deb247bae99311e701a38c
SHA512 0eef055fc7067b6f8dd5770b29a203562fa48707f1ebe8d8e06d79efd887405931b375396cb31328a0cd880bea0e42124fb5012f8183790087d61a9931ba20c0
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	3112	svchost.exe
Token: SeSystemtimePrivilege	3112	svchost.exe
Token: SeIncBasePriorityPrivilege	3112	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 1600	1840	regsvr32.exe	52
PID 1840 wrote to memory of 1600	1840	regsvr32.exe	52
PID 1840 wrote to memory of 1600	1840	regsvr32.exe	52
PID 1600 wrote to memory of 2848	1600	regsvr32.exe	54
PID 1600 wrote to memory of 2848	1600	regsvr32.exe	54
PID 1600 wrote to memory of 2848	1600	regsvr32.exe	54

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_b5e4b36567ff949fd81a2d44063dd59b45309986aae3e7d57a0c71bc4a4fb74a_2022-01-19__132149.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_b5e4b36567ff949fd81a2d44063dd59b45309986aae3e7d57a0c71bc4a4fb74a_2022-01-19__132149.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1600
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_b5e4b36567ff949fd81a2d44063dd59b45309986aae3e7d57a0c71bc4a4fb74a_2022-01-19__132149.exe.dll",DllRegisterServer
    3⤵
    PID:2848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3112

memory/1600-130-0x00000000030C0000-0x00000000030E8000-memory.dmp

Download