Analysis
- max time kernel
158s - max time network
164s - platform
windows10-2004_x64 - resource
win10v2004-20220310-en - submitted
19/03/2022, 00:10
Static task
static1
Behavioral task
behavioral1
Sample
emotet_exe_e5_4df30acec4e4d2439df643e6180684576a44393f2ebbe7489f7683cbb6f67283_2022-03-19__000950.dll
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
General
- Target emotet_exe_e5_4df30acec4e4d2439df643e6180684576a44393f2ebbe7489f7683cbb6f67283_2022-03-19__000950.dll
- Size 567KB
- Sample220319-af42vaggf2
- SHA256 4df30acec4e4d2439df643e6180684576a44393f2ebbe7489f7683cbb6f67283
- MD5 914e260e76725cb7b1b0be995dcb7dfc
- SHA1 a1585fddb70ec6e5df0401aa7499cbf1c0a772b5
- SHA512 044ca37253d17b408375631e6a64e1cb6e2d22588eb24e397150e7cc95b4d145e94ee52f0dbe8584de1616cff67d7e8dc60e0ebd667825e1248c4b5ee50856ed
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch5
C2
-
80.211.107.116:8080
-
188.166.229.148:443
-
121.78.112.42:8080
-
185.148.168.15:8080
-
210.57.209.142:8080
-
194.9.172.107:8080
-
139.196.72.155:8080
-
128.199.192.135:8080
-
62.171.178.147:8080
-
103.133.214.242:8080
-
104.131.62.48:8080
-
103.41.204.169:8080
-
54.37.106.167:8080
-
217.182.143.207:443
-
185.148.168.220:8080
-
202.134.4.210:7080
-
198.199.98.78:8080
-
5.56.132.177:8080
-
66.42.57.149:443
-
78.46.73.125:443
-
191.252.103.16:80
-
54.37.228.122:443
-
88.217.172.165:8080
-
190.90.233.66:443
-
68.183.93.250:443
-
85.25.120.45:8080
-
78.47.204.80:443
-
93.104.209.107:8080
-
37.59.209.141:8080
-
159.69.237.188:443
-
207.148.81.119:8080
-
185.168.130.138:443
-
87.106.97.83:7080
-
45.71.195.104:8080
-
196.44.98.190:8080
-
195.77.239.39:8080
-
36.67.23.59:443
-
103.82.248.59:7080
-
203.153.216.46:443
-
37.44.244.177:8080
-
116.124.128.206:8080
-
2.58.16.87:8080
-
202.28.34.99:8080
-
118.98.72.86:443
-
59.148.253.194:443
-
54.38.242.185:443
-
85.214.67.203:8080
-
195.154.146.35:443
-
103.42.58.120:7080
eck1.plain
ecs1.plain
Signatures
- Drops file in Windows directory 60 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\BIT46A1.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d1d4bb0c910695f4fcf53d8f91faafa7\BITF82E.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\26794b1631618c81e2caec277357b370\daNJ9YVgpN191GzoPynRDpTEDO9uUytOK6Ln7xcN8To= svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\f3535a3b47819a04c6d5ee18905493be086e801e svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\CsA9z1\SlUHUPO8bKnA\BIT9BAA.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\BIT9D70.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\ca4af4339884f7018bf988ecac7702ff\BITB03E.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\ca4af4339884f7018bf988ecac7702ff\BITCBDB.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d1d4bb0c910695f4fcf53d8f91faafa7\Jda7di8befpfPWz3DrhkMwwJL9XbuL8\BITF6F3.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\BIT3E70.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\ca4af4339884f7018bf988ecac7702ff\BITB0CB.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\2ef09e08315a593ec3af8ec57ab6a31e\BITF85E.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\26794b1631618c81e2caec277357b370\BIT55EB.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\cb9f14b7916e97a31f1e53948ed1b67f\6\BIT59B7.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\pj5OoD7hJ+dBGy+3XOjLT8WsuYwervv\BIT4819.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\6feeefdf55ac33c2cb46a25670952111\o\egfDu3QHOC\BITF87.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\26794b1631618c81e2caec277357b370\fbaaae7103d0f0a1303a40d280aa18bafcd08dcf svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\7752a73587b3362d505a041fe7f69ecd\BITBDFD.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d1d4bb0c910695f4fcf53d8f91faafa7\Jda7di8befpfPWz3DrhkMwwJL9XbuL8\fDFnweOZvFE= svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\26794b1631618c81e2caec277357b370\BIT566A.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\7752a73587b3362d505a041fe7f69ecd\BITBE7B.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\BIT4623.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\7752a73587b3362d505a041fe7f69ecd\af66e12c1bb9d8519da21259d0fcd88c247cb4f1 svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\2ef09e08315a593ec3af8ec57ab6a31e\YZBnsYBVNBTl3Isrrjy7P0\BITF7BF.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\2ef09e08315a593ec3af8ec57ab6a31e\6e15245aed25ee83b027521f9cf9ea812c9d016d svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\6feeefdf55ac33c2cb46a25670952111\o\egfDu3QHOC\Xbfe7KpvVnvJHxQ2cRDBmUlnoMnpDY= svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\CsA9z1\SlUHUPO8bKnA\BIT3DA2.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\2ef09e08315a593ec3af8ec57ab6a31e\YZBnsYBVNBTl3Isrrjy7P0\FTTOLXxEZk0li+ZNE2Uo= svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\ca4af4339884f7018bf988ecac7702ff\9+dL4Puh6FM8puPxsBEX86BMeGqpuC0b7gf2fD9DLLo= svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d1d4bb0c910695f4fcf53d8f91faafa7\Jda7di8befpfPWz3DrhkMwwJL9XbuL8\BITFB2D.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\cb9f14b7916e97a31f1e53948ed1b67f\6\BIT550F.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\7752a73587b3362d505a041fe7f69ecd\BITB3DA.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\BIT3E30.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\pj5OoD7hJ+dBGy+3XOjLT8WsuYwervv\LZOCjtiHKk8= svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\ca4af4339884f7018bf988ecac7702ff\BITCB4D.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\2ef09e08315a593ec3af8ec57ab6a31e\YZBnsYBVNBTl3Isrrjy7P0\BIT188.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\cb9f14b7916e97a31f1e53948ed1b67f\BIT564A.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\CsA9z1\SlUHUPO8bKnA\5ondRmJ90JlkPETuN535TWk= svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d1d4bb0c910695f4fcf53d8f91faafa7\BITFBAB.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\BIT4924.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\BIT4160.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\7752a73587b3362d505a041fe7f69ecd\BITB1F5.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\2ef09e08315a593ec3af8ec57ab6a31e\BIT216.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\6feeefdf55ac33c2cb46a25670952111\BIT21D9.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\cb9f14b7916e97a31f1e53948ed1b67f\6\v9GXr9MSfUt92b0dEpOsHH2H0TwcnvKmtIW8g3ovM= svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\pj5OoD7hJ+dBGy+3XOjLT8WsuYwervv\BIT3F8A.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\6feeefdf55ac33c2cb46a25670952111\o\egfDu3QHOC\BITDBF.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\6feeefdf55ac33c2cb46a25670952111\o\egfDu3QHOC\BIT1F09.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\cb9f14b7916e97a31f1e53948ed1b67f\c3ca3df6b0660cc02fa0c60992eb1164c186b223 svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\cb9f14b7916e97a31f1e53948ed1b67f\BIT5A25.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\7752a73587b3362d505a041fe7f69ecd\F2WKV54ysEMEW9U+EfiUeJcNcgfNL4pMC5NmE0a3mAg= svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d1d4bb0c910695f4fcf53d8f91faafa7\d9f2a302574bf135efc9dbd1a8083a336f7f52f0 svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\BIT3C69.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\e1a85885fd4453165061351651289cce8f8590c4 svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\a3f602ea4d534d006919a2613d91f9506b383314 svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\ca4af4339884f7018bf988ecac7702ff\612ad442b8740f4c57b8c84e6bf465ba4699118c svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\6feeefdf55ac33c2cb46a25670952111\2cd32031792245e69c7777193005916861cbbe94 svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\Cmn5TH6S2lFFnfMN8MLr2EoNUIAGzQo2UUjHGMEC99A= svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\6feeefdf55ac33c2cb46a25670952111\BIT1014.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\6feeefdf55ac33c2cb46a25670952111\BITE6C.tmp svchost.exe - Modifies data under HKEY_USERS 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\ApplicationFlags = "1" svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Property svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property\0018400659F1922E = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e00000000020000000000106600000001000020000000d04eaae0335b5b7c7710d8fbb619742e8bbc2831adbefdefaef4d85853064f5f000000000e8000000002000020000000cc831ee4d4e090375b6d7368f3b3c0112aec799e895d5dd422d4b348c217dc228000000035e3b636102340f597f2b0b48e2ebc893f5f2f540f2992b32211ff4a851c3435b9a2e33d4900820174d15bca0569c5b1189644a96fd283a10be2a1e12cadcb5cd8cd7393e657297e471d2b85a9e68a9a1b9b99745301d31580e004272a56f9921eac57b7a445b2018924901ab6f3c1a790b5f0f80cd72ee44f4c5da2e2f1c10d4000000008d612eaddddbee0d7c43d2b640458f5f29357219bbdda87e39ffa910ed05d0479a2bca7108176f07bc907f55084aa1093b28c5bc46c46bbb13f5d57d0983f20 svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5} svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e000000000200000000001066000000010000200000004531fe7cbbdf1254f2560363820b88bf0f49e239df50daf4574bc986a564dae1000000000e8000000002000020000000e7adb63f4b5a6544f142b1c32b8abf9f09dfe34425fd5ffb19b16794ff879c73100d00006c719f812059d4acc31a2c0c5548b59bb71a0f16ff2360def2b729f04bffb53b5e935b252b2ab71c045478c40700e5b8e712ed25d414a8094440db0dbdb001f5ba946cbb8fda1c13543f3553494f6bffafda103e569a157620f2b4415b89b8c26c51097af644bd47c0720179c84d39c3f69d8d63ef2dfe0d25a8759c07e1e9ce8ab05a7a783d294ab8e23443f65b5bd9a42b22956ae7a6f1bdff6976b7ca43d56a958261d3c73aaa8c8dd3cfe9effb7f917be80ff1f7c9baa5d54798d8b49e12593ee212b586aff54a223ab015bdf9a485ae08ae13b5cbef9b4281063020701e5f72cf064bb39315dbeb45e9a6a21ec23531141281f6bac8e165ff93a71db53f2ccf1cf46528af654ca2f360761ff1b67d5754c32b0711d0ed0ab614e491ab9efc71d3aa472ac6a0357462b67a45e8ed557f4064a810263c032613a6989faae766111f3e9c6674a4708c1faf6c61064fef304682cde934f6ac0ceec848cc5210cea84f70d407fa3381be1e0d5fcbdbab1520f7596d732eba81d4a165ef7e7cf676bd45fd8ce299bc643976983ba6f8c139cca217f80844ac4eabafac514d8f609d4090d4435ba9b3480b697be189c14fec068e8c6990f923b6c533fd4d63146665072018c178cff7c47d4ab5da351724f9a38d4d3a589b82b853c94b4735991b9968a6e229bda05994a09549e6380eabd2c532f5b51cf893ff83fc804c5bee45f2af644384197c812408d81675b6fd44286b94900246aeafb09e720d9823ba9dd45e32af441c84323b1d7f3233ff1d79ecbce83a732f57955b723bf56c173b2824cd489372cce47b2fc6a598d5d7bf002480282df6df1b3666fbf88d146197393b7a1d190caf71fdd3b64fea4b7b073e44e38c2e12e3b28f85399ba9e73aae210e44be4094164cf378472836665640969c4dfee04f60ee61bf69f4ef535441c997c19d2525a1ba84d8e0d1af3ab27670d16e27a703626adc4bd0e7fa41b24b5a6a8ffce1a1d0ad2e5c6adb6eb68f94152956ddf63a0ecee6ec778e76be81da66414301a0c2d4dd9bb9a41aadf44685cd6c269850677efad0ae8e2cf07cf7d15f5a07cad367f7c112136ca7371dae8aac1080fd93b3676b29266739cacbb4602d1a7544caaa517a03a8e01b65480a715587c4a825d02862c07dc80c41571da5c87b037ecb062fe810987e3836a422027a0eec59b3798fe6796cc5221141363d6be2f2fcbcbc7e5004cb4063c7b45fabe65caeecb9728fc1eb92217e9bcf4fa5b04e7ef8485a1d748d2e15d37c8c3d2aeb0a3b3e35acee14a308fde00cb5f9b10b6c4e4fc8383b02dec84ed08daad1ab4b5e659348889e5162e7b11ab776f9ce75299214822c0c5a085b9fdfbb2407482dca20993fddd1c083ba84319837b852e4a2c98e8a44bd41f8677245f790f391800bd80650ba4e1d2c8d95b0e5305dd2f90f55b28b38f6e5594e08b4695fa42191c50c7201a3f5a97911d572180c4916cee355fae3514ddcd0fbc8fa92b1f75cb947f67b476f2b140bf507bd5147bba80912a934b4107b89e4b868c84b9e648bee43aea7e0d97be4e162ac163b8792f04d758dafb701699802799cb6ac26202dad888879dc4914aa3c9189fa42af72c0ac07c0b3186b93bad4188a3de1cca2c7aeefffd20919ffe338378b5914b1a0981a1226d9e9f2c5806fe9b0699535532aa8c1521b02565ad52f5ce74129bd0c082890f84518aa62d7b6bb68b369d9a2bfbcd6a0434a28efffa9d41a15ee8d380adc8afbd07a38a603978e4708a7df175d43cf6303ee50fca62fdac69dfd5d447905fc1d53646a889f6526a08f239ac673b37b68ec0f72d8c4af563c83fcc400c200450984a56c42e0434f6a479b02366db6928b247f93afb255072ba8c36c57b8c91ba752643a356d7f4c3fb2d31ce8d3f2bc6ed2c5b5dfe3c5aba4cccafa5f4efe4391545969d25332bf2e9734d3853d788d9427d4ed34089e98c7977471690b5e42cdd85e6b0691bbad81cfe0686aad353623d2745e45532ad1eeab3474bb019db963a1d9db7fa6c0ff48e340bff268b60c1803c94d32711709374612a89058a23d76707b9af17f140124dd9eebcb029dfa75042f079f2cca44cec3cb37911f53be665c093c7da43102afe725274cd940a7d43d7135ab1c2b7bd09c0a8921a6356295133a0755830ec158f2b88dc8e0d6bc2fef4ea7593db1588c482e9acc31f2a570b48583de8d7d0029d87c3f0086bbbbb667cef63a981d0120e32c2a387b625aeca28ac4bc5c19330235a92009b07fb478cf628933c428a61ddf54abeddcc8b1135187eed728a2f0266c70713447c24b5dbd879d925f219cef48c998be2b268174694161b0454e358e516b3f69051377905408592c705de8f7bcff09993ec6852f18b5046eabdcf3256beb39c37e62c9431bf1a96569aaeece9125a5347fa2e45b4c559c517fb10226d8ee462262590c15c9ade9927891cef98039f2c87c79b18a9cf6dd89068c1821aa46c0555fb388b234dfa0f65f921a94f308089260598304781f573e0ad8d46079e5cf86eec71fb567b0ab675335fa16bb4ae148e0df9149967cc6ffdbb6d16fc545da75b7a34035db36447787116f29a690b4994d706a4c4cae85b5eef2f83758cd83b9bc2e71f3a4daa603f757fc31a091423d651a00e26b0cf49188963b8749eb6bb94787192ef7b4cf8e019d130abd37143630e667a34f9e7df5002fdd5d9eb0c94a9b59c09e2145c6cdc604ee94fee003a4fdb718e000eb262b4f82920242c7472ae8a2cdccbd92f6a9f092dbbc047de4895607839fe7a755fe9f342f74d7a61aaadad9f206deb21db96344e5b1b8e64c06f6aaa8d4cf3add64c16ce897bb23129ddd6ced69386d885a679a3df76b7ef539f0abadf6450f92af01242a197db7f426772cbad4c25df6cabb90f651c6d26ee6b85132dedb8f8f4ded4d132cac1311dba4f1d001a2dcee8032ff7dda97e01ba79fd84270d25d9d4fc6f4409de52b082e9331028006b592002dc9731c03fd4e53f0b8870d9be8c2dfb1e230a7a814f250d4d0fa3bbfe96d279f2218dfed9b2f006b2192e784108119d8fb23c1ad7867016c19b638b2c98c5314bfd946c46c5f775961c8dd6cb5308b41bde68bc720f9edf9a416542d37c5520367ec9f107ea026cf83db3b91c5554d8e01503ee002804aee8d4a290ad34074a7444b95c37d49a414dc689970b96d54ecf2eab07e159ff82be9f67254b25199b6de41263ac02e87a334823c9ee75bd773673c312a83b05ea5266f04a75ac4c5083a8a141a651814b4fb796686677b6de54deec625fcba066a2064aa4735ca8888e40db59aaa98401a9f8d508bccc3ebdcc166f5764e6a2a3cd74be728d17d995fc2097d6ba7800017b4fc774644371f78548b3d3e8bd6003d3c61c5f9bc6fcfb3638c87d389f5c0510ffb991b128b5a6c867345d2f3d89ff58f47b687c0ed9a9780e28456194e8013de58c50693b0e8b8310baab445846660e86cac79e74f726086d7b8fac54178f0f1ce8580468dd0f913c38c5490b8cb64103eeefb3719aac6c063abb893a707528a286a0ef68381202e08325ae5a15c2244183ced52183d23e1790f9ac0997db1312057252f3ca38f937eacb0ec467bd7dc6af8b3547ec2f388e73c08d70a5c41ab3a5d5cb9cc2b65a992ef9817d6581d8a3e9925ceb5dfe975c81edba9fa2834828b5a3a86f5ea46c180f7e33cf0ec17899b9291ffa18675ff13a957be4495b05ca542980e8c783ddd0ef6f36b671e8a15fd7e8020f4cd0ee89098d3a78d768aeef3b5a7935b238e27b7f9b093dde32e8d84e5b2df1ce4637db500685a84c810876d752684cb85c838c349e64ee6c0125af0e679cdfffd55c896e9825f7e065ff077b449f64e740058a27ab275ccad9d022973363a8813d11ed13d75c72583a91834c21954cf14d80f59cabfbc16c404dcc83490f41a1f87fb46eb8198af6af8fa5554a8e91033f2df71efcc275e98c3999911e72b2d0096b978f0b1345340e41a093e40e493ecf978bcfacec1bf4ad1a16fe60e217d7f6dd0027d4a42ea9caffc11c3bc54edfa1d10f3b3c4077e29559d539a8282b1b617ceb160ae4a432f38a1cc945d23575f7313c927fb20610e816f04e68a86ab14138576d7e968af58f81b22f1460f2ea9269bf072a6ca36ccf8b20771b250afc2b6ad35b547adf39aabda3d71181462b5e1ca723b82b7739da78a594096899e27f40a5915cf95ab4deaf9df3604580d9bf40ca54a33f33f320b680173daf2ccca53f8bfdbc82453c9bf066d24bab5cae20190d190b64f066af9ac460e6e1cdf12ad2dab500aaf67c7a29ffb4e85e30a5fb83f80b763efcf617826851a453e97b3073548f3ab19b65feb7405c06b9acbc652e5f8d3ebab5f6d5ee3fb37554c5704a8c8768f4a64e34db99615d54299b0abd3dd07971c22e3859c95208c5424444c34bbdaf7eebeed099e2d2f870ebb3a43c84d061fabcf667a9924b3aba84536e8a5d57ed8482ebe7329c4fcb01d1f95fa9f26f1b150f13b54f0f77230235e980562f07960aa2891e77515f7fe623d7357bc723a7fbc86706cfcae946ae4d836924248bdabf53a811f67e811df3acc30d35a953a57828dafa42000f8ba7bc72ce4b3ede9871946496281ad5fbad370adc491a16af35f24c81eaa3f84dca631ad8d075834dfbe716d5e4b0cbbbabd33a479b418228ec37095e5c6774000000060987b6e3fe50536275ce9af9dcce992aefe24ec6c63590fdde0dde6b51c0cb22d061e97926f04e431e7c91ae94376050ad5c9f31288fe720135e13b64026a48 svchost.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceId = "0018400659F1922E" svchost.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4372 regsvr32.exe 4372 regsvr32.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1720 wrote to memory of 4372 1720 regsvr32.exe 82 PID 1720 wrote to memory of 4372 1720 regsvr32.exe 82 PID 1720 wrote to memory of 4372 1720 regsvr32.exe 82
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_4df30acec4e4d2439df643e6180684576a44393f2ebbe7489f7683cbb6f67283_2022-03-19__000950.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_4df30acec4e4d2439df643e6180684576a44393f2ebbe7489f7683cbb6f67283_2022-03-19__000950.dll2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4372
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
- Modifies data under HKEY_USERS
PID:4284
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Drops file in Windows directory
PID:3152
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵PID:4956