emotet | 9b3fb63dea4b772cd36e83ccc98201008c2fe670cf74e3341066a77eb2d565c8

Analysis

max time kernel
4265074s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
18/01/2022, 00:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
emotet_exe_e5_9b3fb63dea4b772cd36e83ccc98201008c2fe670cf74e3341066a77eb2d565c8_2022-01-18__000719.exe.dll
Size 469KB
Sample220118-aexalsecb5
SHA256 9b3fb63dea4b772cd36e83ccc98201008c2fe670cf74e3341066a77eb2d565c8
MD5 89fb6f129af226fbf2c953257e0a1eb2
SHA1 3fb3a8fb103258ed3d7ff01a5f4fd22689bace2e
SHA512 b0b1341cc9c76546cbab130fd6682e6bde246c065db9df1598ff0e4a380c21b05f9f39022c6e58bad2383b352d8fb26ac8c8be47dec77577c6abfb4d27fe28a1
MD5 SHA1 SHA512

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotification.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotification.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3460	MusNotification.exe
Token: SeCreatePagefilePrivilege	3460	MusNotification.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 224	2732	regsvr32.exe	54
PID 2732 wrote to memory of 224	2732	regsvr32.exe	54
PID 2732 wrote to memory of 224	2732	regsvr32.exe	54
PID 224 wrote to memory of 660	224	regsvr32.exe	55
PID 224 wrote to memory of 660	224	regsvr32.exe	55
PID 224 wrote to memory of 660	224	regsvr32.exe	55

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_9b3fb63dea4b772cd36e83ccc98201008c2fe670cf74e3341066a77eb2d565c8_2022-01-18__000719.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_9b3fb63dea4b772cd36e83ccc98201008c2fe670cf74e3341066a77eb2d565c8_2022-01-18__000719.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:224
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_9b3fb63dea4b772cd36e83ccc98201008c2fe670cf74e3341066a77eb2d565c8_2022-01-18__000719.exe.dll",DllRegisterServer
    3⤵
    PID:660

C:\Windows\system32\MusNotification.exe
C:\Windows\system32\MusNotification.exe
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3460

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/224-131-0x0000000003591000-0x00000000035B3000-memory.dmp

Download

memory/224-132-0x00000000035B3000-0x00000000035B4000-memory.dmp