emotet | 527d3c29c029510db2f6224c490b45b48ee3bd1cb8d97748af016b34e0217ce4

General

Target
emotet_exe_e4_527d3c29c029510db2f6224c490b45b48ee3bd1cb8d97748af016b34e0217ce4_2022-02-08__064044.dll
Size 763KB
Sample220208-hfsb2seedk
SHA256 527d3c29c029510db2f6224c490b45b48ee3bd1cb8d97748af016b34e0217ce4
MD5 36955847db4d86596ce1e37dbd395dd9
SHA1 3115a227fddd820bc3623d13904a61554897cbd5
SHA512 e6cb17716eb403c9a0dfcf5f4ebec0fcd98f701b81c3dab196977e7445b8a93a90579bf61ead6b60b50a864e3efd84fdbfb0a09dacfdb785c56fa11ecfcb495d
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

C2

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4904	svchost.exe
Token: SeCreatePagefilePrivilege	4904	svchost.exe
Token: SeShutdownPrivilege	4904	svchost.exe
Token: SeCreatePagefilePrivilege	4904	svchost.exe
Token: SeShutdownPrivilege	4904	svchost.exe
Token: SeCreatePagefilePrivilege	4904	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 1268	4216	regsvr32.exe	82
PID 4216 wrote to memory of 1268	4216	regsvr32.exe	82
PID 4216 wrote to memory of 1268	4216	regsvr32.exe	82
PID 1268 wrote to memory of 3240	1268	regsvr32.exe	85
PID 1268 wrote to memory of 3240	1268	regsvr32.exe	85
PID 1268 wrote to memory of 3240	1268	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_527d3c29c029510db2f6224c490b45b48ee3bd1cb8d97748af016b34e0217ce4_2022-02-08__064044.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_527d3c29c029510db2f6224c490b45b48ee3bd1cb8d97748af016b34e0217ce4_2022-02-08__064044.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1268
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_527d3c29c029510db2f6224c490b45b48ee3bd1cb8d97748af016b34e0217ce4_2022-02-08__064044.dll",DllRegisterServer
    3⤵
    PID:3240

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
PID:3768

memory/1268-130-0x0000000010000000-0x0000000010028000-memory.dmp

Download

memory/4904-144-0x00000273EDBC0000-0x00000273EDBC4000-memory.dmp

Download