emotet | 21f6d02ff4e35e203a48b67a424135fc6bae177fa4e6d827612c924585b3a6f6

Analysis

Target
f5f77090e40dcb8472497bb7c46bdc28.dll
Size 408KB
Sample220119-rc975aadhj
SHA256 21f6d02ff4e35e203a48b67a424135fc6bae177fa4e6d827612c924585b3a6f6
MD5 f5f77090e40dcb8472497bb7c46bdc28
SHA1 abce52afe2532dcde08d72c53e753a1ce4e6ccff
SHA512 a93bf8d6b4b18982fc33fe9e6e9139a1a4c5fdbca42be2fd238e842eb31c624ade27c70e554d16963aea1fbc8df412305e54a3d3424dfa25d0cf380b561b7f0e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	3812	svchost.exe
Token: SeSystemtimePrivilege	3812	svchost.exe
Token: SeIncBasePriorityPrivilege	3812	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 3256	1972	regsvr32.exe	51
PID 1972 wrote to memory of 3256	1972	regsvr32.exe	51
PID 1972 wrote to memory of 3256	1972	regsvr32.exe	51
PID 3256 wrote to memory of 1580	3256	regsvr32.exe	52
PID 3256 wrote to memory of 1580	3256	regsvr32.exe	52
PID 3256 wrote to memory of 1580	3256	regsvr32.exe	52

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f5f77090e40dcb8472497bb7c46bdc28.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f5f77090e40dcb8472497bb7c46bdc28.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3256
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\f5f77090e40dcb8472497bb7c46bdc28.dll",DllRegisterServer
    3⤵
    PID:1580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3812

memory/3256-131-0x00000000036A0000-0x00000000036C6000-memory.dmp

Download