emotet | 50437a0fcfb45356ced8ec185421bfbcb62ec3dd26826d348f11099b64da044e

Analysis

max time kernel
4265066s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
18/01/2022, 00:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
emotet_exe_e5_50437a0fcfb45356ced8ec185421bfbcb62ec3dd26826d348f11099b64da044e_2022-01-18__000719.exe.dll
Size 469KB
Sample220118-aexalsefem
SHA256 50437a0fcfb45356ced8ec185421bfbcb62ec3dd26826d348f11099b64da044e
MD5 a8b595feb326ed5e1db5e314eb56ebba
SHA1 0b5e3d1972ad122ce6a0bd99f18cafc5a948471b
SHA512 865c58926f8fb7f27fd04b413674c7c8bd2205279e7021852bc5efa053d6a7480dfe26fbbff18d97f9476626f9a651601c6cd388cad04cb81d6f863c83a1e344
MD5 SHA1 SHA512

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotification.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotification.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4016	MusNotification.exe
Token: SeCreatePagefilePrivilege	4016	MusNotification.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 4032	3076	regsvr32.exe	53
PID 3076 wrote to memory of 4032	3076	regsvr32.exe	53
PID 3076 wrote to memory of 4032	3076	regsvr32.exe	53
PID 4032 wrote to memory of 2440	4032	regsvr32.exe	54
PID 4032 wrote to memory of 2440	4032	regsvr32.exe	54
PID 4032 wrote to memory of 2440	4032	regsvr32.exe	54

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_50437a0fcfb45356ced8ec185421bfbcb62ec3dd26826d348f11099b64da044e_2022-01-18__000719.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_50437a0fcfb45356ced8ec185421bfbcb62ec3dd26826d348f11099b64da044e_2022-01-18__000719.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4032
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_50437a0fcfb45356ced8ec185421bfbcb62ec3dd26826d348f11099b64da044e_2022-01-18__000719.exe.dll",DllRegisterServer
    3⤵
    PID:2440

C:\Windows\system32\MusNotification.exe
C:\Windows\system32\MusNotification.exe
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4032-132-0x0000000004873000-0x0000000004874000-memory.dmp

Download

memory/4032-131-0x0000000004851000-0x0000000004873000-memory.dmp