f33e01b368ae6683dc8e954d589dfabd0d42212446d20c0af4433cdcaf40ef74

Analysis

max time kernel
4265059s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
18/01/2022, 00:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
emotet_exe_e5_f33e01b368ae6683dc8e954d589dfabd0d42212446d20c0af4433cdcaf40ef74_2022-01-18__000718.exe.dll
Size 479KB
Sample220118-aexalsecb6
SHA256 f33e01b368ae6683dc8e954d589dfabd0d42212446d20c0af4433cdcaf40ef74
MD5 78ebaa8574e0a6f0a99c116a8a15fa25
SHA1 864e3680b8578a89adbb261726006356f3ea2585
SHA512 8419878e17b6bd2fe653c77a2e05b274b23d46e559d5651cdba1c4c46e946d8c0439123f82c355ebd96752989b712f8701a11daeff0af3cd5e6d2a05636c7422
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotification.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotification.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2228	MusNotification.exe
Token: SeCreatePagefilePrivilege	2228	MusNotification.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3972 wrote to memory of 3372	3972	regsvr32.exe	52
PID 3972 wrote to memory of 3372	3972	regsvr32.exe	52
PID 3972 wrote to memory of 3372	3972	regsvr32.exe	52
PID 3372 wrote to memory of 2112	3372	regsvr32.exe	55
PID 3372 wrote to memory of 2112	3372	regsvr32.exe	55
PID 3372 wrote to memory of 2112	3372	regsvr32.exe	55

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_f33e01b368ae6683dc8e954d589dfabd0d42212446d20c0af4433cdcaf40ef74_2022-01-18__000718.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_f33e01b368ae6683dc8e954d589dfabd0d42212446d20c0af4433cdcaf40ef74_2022-01-18__000718.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3372
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_f33e01b368ae6683dc8e954d589dfabd0d42212446d20c0af4433cdcaf40ef74_2022-01-18__000718.exe.dll",DllRegisterServer
    3⤵
    PID:2112

C:\Windows\system32\MusNotification.exe
C:\Windows\system32\MusNotification.exe
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2228

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3372-132-0x0000000004EE5000-0x0000000004EE6000-memory.dmp

Download

memory/3372-131-0x0000000004EC1000-0x0000000004EE5000-memory.dmp