Analysis
- max time kernel
121s - max time network
127s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
26/11/2021, 09:01
Static task
static1
Behavioral task
behavioral1
Sample
Emotet_n2.bin.dll
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Emotet_n2.bin.dll
Resource
win10-en-20211104
windows10_x64
0 signatures
0 seconds
General
- Target Emotet_n2.bin.dll
- Size 474KB
- Sample211126-kywtasbdfl
- SHA256 7602e725df3f2b046f7b9c4f6a7e400a53837b45367b97196f1eabe6dcef1ff9
- MD5 65e2eb7a556242501a095b8249316ea3
- SHA1 24f9eec087eef53a1f78d3a74134ac859258e9e3
- SHA512 8f5f2fa90e47038512174d6e080e25984afdbd347163e6ebf112a8a221d4a7af137f6acfd780476d32ac4e93fa46bc649e6664bf02f7f0401d6b5e2d00c3737d
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 3936 created 2772 3936 WerFault.exe 68 - Program crash 2 IoCs
pid pid_target Process procid_target 3932 2772 WerFault.exe 68 3936 2772 WerFault.exe 68 - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 3932 WerFault.exe 3932 WerFault.exe 3932 WerFault.exe 3932 WerFault.exe 3932 WerFault.exe 3932 WerFault.exe 3932 WerFault.exe 3932 WerFault.exe 3932 WerFault.exe 3932 WerFault.exe 3932 WerFault.exe 3932 WerFault.exe 3936 WerFault.exe 3936 WerFault.exe 3936 WerFault.exe 3936 WerFault.exe 3936 WerFault.exe 3936 WerFault.exe 3936 WerFault.exe 3936 WerFault.exe 3936 WerFault.exe 3936 WerFault.exe 3936 WerFault.exe 3936 WerFault.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 3932 WerFault.exe Token: SeBackupPrivilege 3932 WerFault.exe Token: SeDebugPrivilege 3932 WerFault.exe Token: SeDebugPrivilege 3936 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2728 wrote to memory of 2772 2728 rundll32.exe 68 PID 2728 wrote to memory of 2772 2728 rundll32.exe 68 PID 2728 wrote to memory of 2772 2728 rundll32.exe 68
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Emotet_n2.bin.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Emotet_n2.bin.dll,#12⤵PID:2772
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 6083⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3932
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 6323⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3936
-
-