c9d5d893e0dff8b63efab77eaca699f35aa73d1b8efafaa5a4481a05a04a0c40

Analysis

Target
emotet_exe_e5_c9d5d893e0dff8b63efab77eaca699f35aa73d1b8efafaa5a4481a05a04a0c40_2022-02-06__000348.dll
Size 1.0MB
Sample220206-acmcmagab8
SHA256 c9d5d893e0dff8b63efab77eaca699f35aa73d1b8efafaa5a4481a05a04a0c40
MD5 d0e1c875bc6e74e859952a1cf9aad470
SHA1 683e9dde000aa4ca60f59f2fdfc3e7bc50b8637f
SHA512 0fba0fdc4bb1e8a330308508fdcab549b2849e76131e16ad553af0f96f5f208c8d78a8c6ec3e4dfd0915d6e8c72bd347b3858da65e17e31fe14012623b1c0613
MD5 SHA1 SHA512

Score

4^/10

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2752	svchost.exe
Token: SeCreatePagefilePrivilege	2752	svchost.exe
Token: SeShutdownPrivilege	2752	svchost.exe
Token: SeCreatePagefilePrivilege	2752	svchost.exe
Token: SeShutdownPrivilege	2752	svchost.exe
Token: SeCreatePagefilePrivilege	2752	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 4336	2704	regsvr32.exe	82
PID 2704 wrote to memory of 4336	2704	regsvr32.exe	82
PID 2704 wrote to memory of 4336	2704	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_c9d5d893e0dff8b63efab77eaca699f35aa73d1b8efafaa5a4481a05a04a0c40_2022-02-06__000348.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_c9d5d893e0dff8b63efab77eaca699f35aa73d1b8efafaa5a4481a05a04a0c40_2022-02-06__000348.dll
  2⤵
  PID:4336

memory/2752-142-0x00000194B7B50000-0x00000194B7B54000-memory.dmp

Download