emotet | 7dbdb90598e98e9459342e6d4fe90dce572f06a402714df88582bdb36e7a42ed

Analysis

max time kernel
4265091s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
17/01/2022, 21:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
emotet_exe_e5_7dbdb90598e98e9459342e6d4fe90dce572f06a402714df88582bdb36e7a42ed_2022-01-17__214351.exe.dll
Size 460KB
Sample220117-1lhc5sdcfj
SHA256 7dbdb90598e98e9459342e6d4fe90dce572f06a402714df88582bdb36e7a42ed
MD5 979d685bd99f7f7a47cf2453b5c53f02
SHA1 f065fee0d1efe60833c99198b53d6be4e3b3bf53
SHA512 30b5390db36b237518b2e8ff983b1b6d3829dacb0575422691f2d824e27a1c25f25b6800ce4d66217d626591ac24a8f153751a23ab7f9663626bcdd691eaef38
MD5 SHA1 SHA512

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotification.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotification.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2924	MusNotification.exe
Token: SeCreatePagefilePrivilege	2924	MusNotification.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3748 wrote to memory of 3392	3748	regsvr32.exe	55
PID 3748 wrote to memory of 3392	3748	regsvr32.exe	55
PID 3748 wrote to memory of 3392	3748	regsvr32.exe	55
PID 3392 wrote to memory of 3716	3392	regsvr32.exe	59
PID 3392 wrote to memory of 3716	3392	regsvr32.exe	59
PID 3392 wrote to memory of 3716	3392	regsvr32.exe	59

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_7dbdb90598e98e9459342e6d4fe90dce572f06a402714df88582bdb36e7a42ed_2022-01-17__214351.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3748
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_7dbdb90598e98e9459342e6d4fe90dce572f06a402714df88582bdb36e7a42ed_2022-01-17__214351.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3392
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_7dbdb90598e98e9459342e6d4fe90dce572f06a402714df88582bdb36e7a42ed_2022-01-17__214351.exe.dll",DllRegisterServer
    3⤵
    PID:3716

C:\Windows\system32\MusNotification.exe
C:\Windows\system32\MusNotification.exe
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3392-132-0x0000000004663000-0x0000000004664000-memory.dmp

Download

memory/3392-131-0x0000000004641000-0x0000000004663000-memory.dmp