bbdc1489d7d512d88b7c85ac32c3e37ab35d270ec887de2c95c7cc5459b01e1c

Analysis

Target
emotet_exe_e4_bbdc1489d7d512d88b7c85ac32c3e37ab35d270ec887de2c95c7cc5459b01e1c_2022-02-06__000334.dll
Size 997KB
Sample220206-acmcmagab6
SHA256 bbdc1489d7d512d88b7c85ac32c3e37ab35d270ec887de2c95c7cc5459b01e1c
MD5 66b6c0d717f87b935a7a3b5500f6c278
SHA1 1ceee4901d3b3183d123b9094a435bf61f007b06
SHA512 3dfaf1ce3a782ad84a020e959f27765274817435ca91590535cf365e06bea0b5e438651608f7abbda30b56c63caeae2017211303c9a585d098c39e194f1607b0
MD5 SHA1 SHA512

Score

4^/10

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2008	svchost.exe
Token: SeCreatePagefilePrivilege	2008	svchost.exe
Token: SeShutdownPrivilege	2008	svchost.exe
Token: SeCreatePagefilePrivilege	2008	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 4676	2960	regsvr32.exe	82
PID 2960 wrote to memory of 4676	2960	regsvr32.exe	82
PID 2960 wrote to memory of 4676	2960	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_bbdc1489d7d512d88b7c85ac32c3e37ab35d270ec887de2c95c7cc5459b01e1c_2022-02-06__000334.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_bbdc1489d7d512d88b7c85ac32c3e37ab35d270ec887de2c95c7cc5459b01e1c_2022-02-06__000334.dll
  2⤵
  PID:4676

memory/2008-130-0x0000022D4FD80000-0x0000022D4FD90000-memory.dmp

Download

memory/2008-137-0x0000022D53160000-0x0000022D53164000-memory.dmp

Download