73f3bf4a298865bfff2f9dfe980ae472f8464c50dfe8e3d85a0b121362ca6c5c

Analysis

max time kernel
4265041s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
18/01/2022, 00:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
emotet_exe_e5_73f3bf4a298865bfff2f9dfe980ae472f8464c50dfe8e3d85a0b121362ca6c5c_2022-01-18__000721.exe.dll
Size 479KB
Sample220118-aexldaefeq
SHA256 73f3bf4a298865bfff2f9dfe980ae472f8464c50dfe8e3d85a0b121362ca6c5c
MD5 c810f55b95c2c8386e2a9333391dc49d
SHA1 0347877f99f380808861dcf16b95afd972372dcf
SHA512 cb9f3ca180b84c9a6c6f490d92b19c453f642e82b2bf929e8f3497f392dddf058cd8489f2502472b703033928c7302b17d5f9cdcc793e51a594ebd6afe65743a
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotification.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotification.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3192	MusNotification.exe
Token: SeCreatePagefilePrivilege	3192	MusNotification.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 2820	3336	regsvr32.exe	54
PID 3336 wrote to memory of 2820	3336	regsvr32.exe	54
PID 3336 wrote to memory of 2820	3336	regsvr32.exe	54
PID 2820 wrote to memory of 3836	2820	regsvr32.exe	55
PID 2820 wrote to memory of 3836	2820	regsvr32.exe	55
PID 2820 wrote to memory of 3836	2820	regsvr32.exe	55

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_73f3bf4a298865bfff2f9dfe980ae472f8464c50dfe8e3d85a0b121362ca6c5c_2022-01-18__000721.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_73f3bf4a298865bfff2f9dfe980ae472f8464c50dfe8e3d85a0b121362ca6c5c_2022-01-18__000721.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_73f3bf4a298865bfff2f9dfe980ae472f8464c50dfe8e3d85a0b121362ca6c5c_2022-01-18__000721.exe.dll",DllRegisterServer
    3⤵
    PID:3836

C:\Windows\system32\MusNotification.exe
C:\Windows\system32\MusNotification.exe
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3192

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2820-133-0x0000000004AC5000-0x0000000004AC6000-memory.dmp

Download

memory/2820-132-0x0000000004AA1000-0x0000000004AC5000-memory.dmp