emotet | bd5fcd89ffbb9c3d74a4b0e1950255c77ce875d03f62efd27a9eca04c0c3e95a

Analysis

max time kernel
4265071s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
17/01/2022, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
emotet_exe_e5_bd5fcd89ffbb9c3d74a4b0e1950255c77ce875d03f62efd27a9eca04c0c3e95a_2022-01-17__222719.exe.dll
Size 469KB
Sample220117-2dpypadgdl
SHA256 bd5fcd89ffbb9c3d74a4b0e1950255c77ce875d03f62efd27a9eca04c0c3e95a
MD5 b0ae5a58a8b18d8b7abe46de51f4c3f6
SHA1 3cd920f0903d5422688dc22fb16b3b9a514582f2
SHA512 da0bef66999c9970a052ddf8471db9e33a00cd2054877306e29ebb57e2ac680243d6695b2c8f2fbd8ff7c40f4e2164796e323eb563dd2b15ef84383a579c8e07
MD5 SHA1 SHA512

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotification.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotification.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2628	MusNotification.exe
Token: SeCreatePagefilePrivilege	2628	MusNotification.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 940	1156	regsvr32.exe	53
PID 1156 wrote to memory of 940	1156	regsvr32.exe	53
PID 1156 wrote to memory of 940	1156	regsvr32.exe	53
PID 940 wrote to memory of 1720	940	regsvr32.exe	54
PID 940 wrote to memory of 1720	940	regsvr32.exe	54
PID 940 wrote to memory of 1720	940	regsvr32.exe	54

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_bd5fcd89ffbb9c3d74a4b0e1950255c77ce875d03f62efd27a9eca04c0c3e95a_2022-01-17__222719.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_bd5fcd89ffbb9c3d74a4b0e1950255c77ce875d03f62efd27a9eca04c0c3e95a_2022-01-17__222719.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_bd5fcd89ffbb9c3d74a4b0e1950255c77ce875d03f62efd27a9eca04c0c3e95a_2022-01-17__222719.exe.dll",DllRegisterServer
    3⤵
    PID:1720

C:\Windows\system32\MusNotification.exe
C:\Windows\system32\MusNotification.exe
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/940-131-0x00000000048E1000-0x0000000004903000-memory.dmp

Download

memory/940-132-0x0000000004903000-0x0000000004904000-memory.dmp