5fd4ee7ad60305c05433af4b60bde2b078b709fedbfd99c0cbcda635a593c1d9

Analysis

Target
emotet_exe_e5_5fd4ee7ad60305c05433af4b60bde2b078b709fedbfd99c0cbcda635a593c1d9_2022-02-06__000348.dll
Size 1.0MB
Sample220206-acmcmagab7
SHA256 5fd4ee7ad60305c05433af4b60bde2b078b709fedbfd99c0cbcda635a593c1d9
MD5 3ea7b766f43c26009217b09c39ae740f
SHA1 81be2088440b8f463db976c02a6e694594ae61da
SHA512 a31d4848410f7629c80b5f0a47643bf40261b3d8ad23284063eb784b48cccf4e09c23efbe5a5796a97abfe6e85243d0813efadcc8124bdaab56157cc26f9b9c9
MD5 SHA1 SHA512

Score

4^/10

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2484	svchost.exe
Token: SeCreatePagefilePrivilege	2484	svchost.exe
Token: SeShutdownPrivilege	2484	svchost.exe
Token: SeCreatePagefilePrivilege	2484	svchost.exe
Token: SeShutdownPrivilege	2484	svchost.exe
Token: SeCreatePagefilePrivilege	2484	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 4240	4980	regsvr32.exe	81
PID 4980 wrote to memory of 4240	4980	regsvr32.exe	81
PID 4980 wrote to memory of 4240	4980	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_5fd4ee7ad60305c05433af4b60bde2b078b709fedbfd99c0cbcda635a593c1d9_2022-02-06__000348.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_5fd4ee7ad60305c05433af4b60bde2b078b709fedbfd99c0cbcda635a593c1d9_2022-02-06__000348.dll
  2⤵
  PID:4240

memory/2484-130-0x0000021ED3380000-0x0000021ED3390000-memory.dmp

Download

memory/2484-137-0x0000021ED6000000-0x0000021ED6004000-memory.dmp

Download