emotet | cd543d667e2c5fdd5ad2c5ace779ef6ec2e77797565a042531b50fbd42113107

Analysis

max time kernel
4265058s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
17/01/2022, 23:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6efba9d68e7b509b06c08ba0a8da1324.dll
Size 469KB
Sample220117-259geaeber
SHA256 cd543d667e2c5fdd5ad2c5ace779ef6ec2e77797565a042531b50fbd42113107
MD5 6efba9d68e7b509b06c08ba0a8da1324
SHA1 ee551d073ea024745dab15b41fec131c7f3e374e
SHA512 926124effa9a66f3664fb6059524fec99adddd9435cffbd92fe709b47676d18ab670fe40403b31e9e9352e44121084857a1d01c2d1404012836d30ed08d45798
MD5 SHA1 SHA512

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotification.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotification.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3880	MusNotification.exe
Token: SeCreatePagefilePrivilege	3880	MusNotification.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 216	3932	regsvr32.exe	53
PID 3932 wrote to memory of 216	3932	regsvr32.exe	53
PID 3932 wrote to memory of 216	3932	regsvr32.exe	53
PID 216 wrote to memory of 3924	216	regsvr32.exe	54
PID 216 wrote to memory of 3924	216	regsvr32.exe	54
PID 216 wrote to memory of 3924	216	regsvr32.exe	54

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6efba9d68e7b509b06c08ba0a8da1324.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\6efba9d68e7b509b06c08ba0a8da1324.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:216
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6efba9d68e7b509b06c08ba0a8da1324.dll",DllRegisterServer
    3⤵
    PID:3924

C:\Windows\system32\MusNotification.exe
C:\Windows\system32\MusNotification.exe
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3880

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/216-132-0x0000000002D63000-0x0000000002D64000-memory.dmp

Download

memory/216-131-0x0000000002D41000-0x0000000002D63000-memory.dmp