emotet | c4b34701b175cf6b02d30c4633396f2602ecdd36ba6ca7b3d8a047d47083eae4

General

Target
emotet_exe_e5_c4b34701b175cf6b02d30c4633396f2602ecdd36ba6ca7b3d8a047d47083eae4_2022-02-07__135748.dll
Size 216KB
Sample220207-q9vm9scfdm
SHA256 c4b34701b175cf6b02d30c4633396f2602ecdd36ba6ca7b3d8a047d47083eae4
MD5 955d8483aebd7708f77f8bfe651b8487
SHA1 6c205342af84ac4974316164267857588b3c4bee
SHA512 5995a3c7ff056db1325c41ff9556b46cc8741fb58b1b489620be7c8d1763fcf492861e5570a1c3885fcf9d1ae75e74aeabfba78e11e3982f29768b59d414d881
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

C2

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3788	svchost.exe
Token: SeCreatePagefilePrivilege	3788	svchost.exe
Token: SeShutdownPrivilege	3788	svchost.exe
Token: SeCreatePagefilePrivilege	3788	svchost.exe
Token: SeShutdownPrivilege	3788	svchost.exe
Token: SeCreatePagefilePrivilege	3788	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3512 wrote to memory of 1516	3512	regsvr32.exe	81
PID 3512 wrote to memory of 1516	3512	regsvr32.exe	81
PID 3512 wrote to memory of 1516	3512	regsvr32.exe	81
PID 1516 wrote to memory of 4916	1516	regsvr32.exe	82
PID 1516 wrote to memory of 4916	1516	regsvr32.exe	82
PID 1516 wrote to memory of 4916	1516	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_c4b34701b175cf6b02d30c4633396f2602ecdd36ba6ca7b3d8a047d47083eae4_2022-02-07__135748.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_c4b34701b175cf6b02d30c4633396f2602ecdd36ba6ca7b3d8a047d47083eae4_2022-02-07__135748.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_c4b34701b175cf6b02d30c4633396f2602ecdd36ba6ca7b3d8a047d47083eae4_2022-02-07__135748.dll",DllRegisterServer
    3⤵
    PID:4916

memory/1516-130-0x0000000010000000-0x0000000010026000-memory.dmp

Download

memory/3788-132-0x000001B1AAB80000-0x000001B1AAB90000-memory.dmp

Download

memory/3788-139-0x000001B1AD800000-0x000001B1AD804000-memory.dmp

Download