18ef7add82c3fc19e47143ff336e8b6289dbacb19c51f4cfcede7812ace434fe

Analysis

max time kernel
4265074s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
15/01/2022, 00:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
emotet_exe_e5_18ef7add82c3fc19e47143ff336e8b6289dbacb19c51f4cfcede7812ace434fe_2022-01-15__000450.exe.dll
Size 574KB
Sample220115-ac87dsbdf8
SHA256 18ef7add82c3fc19e47143ff336e8b6289dbacb19c51f4cfcede7812ace434fe
MD5 02fc0aa12f09b9a31e6f3b9220b5a681
SHA1 2323d324825d4981fa0cba45044506203cee9d72
SHA512 e93e52e8ae6b395412c313b46cd954ee8e76cc931df858e7183061e83723e4709e36c0f167a817efd2a868ac887fa5582af9b46eb6799e7de62cf6463ebaf07b
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotification.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotification.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3432	MusNotification.exe
Token: SeCreatePagefilePrivilege	3432	MusNotification.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 3264	2592	regsvr32.exe	54
PID 2592 wrote to memory of 3264	2592	regsvr32.exe	54
PID 2592 wrote to memory of 3264	2592	regsvr32.exe	54
PID 3264 wrote to memory of 3736	3264	regsvr32.exe	56
PID 3264 wrote to memory of 3736	3264	regsvr32.exe	56
PID 3264 wrote to memory of 3736	3264	regsvr32.exe	56

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_18ef7add82c3fc19e47143ff336e8b6289dbacb19c51f4cfcede7812ace434fe_2022-01-15__000450.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_18ef7add82c3fc19e47143ff336e8b6289dbacb19c51f4cfcede7812ace434fe_2022-01-15__000450.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3264
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_18ef7add82c3fc19e47143ff336e8b6289dbacb19c51f4cfcede7812ace434fe_2022-01-15__000450.exe.dll",DllRegisterServer
    3⤵
    PID:3736

C:\Windows\system32\MusNotification.exe
C:\Windows\system32\MusNotification.exe
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3432

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3264-132-0x0000000004965000-0x0000000004966000-memory.dmp

Download

memory/3264-131-0x0000000004941000-0x0000000004965000-memory.dmp