Analysis
- max time kernel
135s - max time network
163s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
08/02/2022, 00:01
Static task
static1
Behavioral task
behavioral1
Sample
emotet_exe_e4_af13fc97525330c017e2a4785adff36aa66e70b3f400b540ad73e7190b8c7c2d_2022-02-08__000029.dll
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
emotet_exe_e4_af13fc97525330c017e2a4785adff36aa66e70b3f400b540ad73e7190b8c7c2d_2022-02-08__000029.dll
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target emotet_exe_e4_af13fc97525330c017e2a4785adff36aa66e70b3f400b540ad73e7190b8c7c2d_2022-02-08__000029.dll
- Size 608KB
- Sample220208-aaxetaahem
- SHA256 af13fc97525330c017e2a4785adff36aa66e70b3f400b540ad73e7190b8c7c2d
- MD5 b9f6a0c87776af7c4bd27b9911e3ac24
- SHA1 eb4255ab752208660d72bea062c8b4e836d5ccf4
- SHA512 a1521e834c60e13286341fc8321cc28aeeb6359e05890ee4fb51f48a43607bf2138e617e1a0db957f4937664a1ff5e74a0b3c2136b40f759a13639879dcf5661
- MD5 SHA1 SHA512
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1152 svchost.exe Token: SeCreatePagefilePrivilege 1152 svchost.exe Token: SeShutdownPrivilege 1152 svchost.exe Token: SeCreatePagefilePrivilege 1152 svchost.exe Token: SeShutdownPrivilege 1152 svchost.exe Token: SeCreatePagefilePrivilege 1152 svchost.exe Token: SeSecurityPrivilege 3976 TiWorker.exe Token: SeRestorePrivilege 3976 TiWorker.exe Token: SeBackupPrivilege 3976 TiWorker.exe Token: SeBackupPrivilege 3976 TiWorker.exe Token: SeRestorePrivilege 3976 TiWorker.exe Token: SeSecurityPrivilege 3976 TiWorker.exe Token: SeBackupPrivilege 3976 TiWorker.exe Token: SeRestorePrivilege 3976 TiWorker.exe Token: SeSecurityPrivilege 3976 TiWorker.exe Token: SeBackupPrivilege 3976 TiWorker.exe Token: SeRestorePrivilege 3976 TiWorker.exe Token: SeSecurityPrivilege 3976 TiWorker.exe Token: SeBackupPrivilege 3976 TiWorker.exe Token: SeRestorePrivilege 3976 TiWorker.exe Token: SeSecurityPrivilege 3976 TiWorker.exe Token: SeBackupPrivilege 3976 TiWorker.exe Token: SeRestorePrivilege 3976 TiWorker.exe Token: SeSecurityPrivilege 3976 TiWorker.exe Token: SeBackupPrivilege 3976 TiWorker.exe Token: SeRestorePrivilege 3976 TiWorker.exe Token: SeSecurityPrivilege 3976 TiWorker.exe Token: SeBackupPrivilege 3976 TiWorker.exe Token: SeRestorePrivilege 3976 TiWorker.exe Token: SeSecurityPrivilege 3976 TiWorker.exe Token: SeBackupPrivilege 3976 TiWorker.exe Token: SeRestorePrivilege 3976 TiWorker.exe Token: SeSecurityPrivilege 3976 TiWorker.exe Token: SeBackupPrivilege 3976 TiWorker.exe Token: SeRestorePrivilege 3976 TiWorker.exe Token: SeSecurityPrivilege 3976 TiWorker.exe Token: SeBackupPrivilege 3976 TiWorker.exe Token: SeRestorePrivilege 3976 TiWorker.exe Token: SeSecurityPrivilege 3976 TiWorker.exe Token: SeBackupPrivilege 3976 TiWorker.exe Token: SeRestorePrivilege 3976 TiWorker.exe Token: SeSecurityPrivilege 3976 TiWorker.exe Token: SeBackupPrivilege 3976 TiWorker.exe Token: SeRestorePrivilege 3976 TiWorker.exe Token: SeSecurityPrivilege 3976 TiWorker.exe Token: SeBackupPrivilege 3976 TiWorker.exe Token: SeRestorePrivilege 3976 TiWorker.exe Token: SeSecurityPrivilege 3976 TiWorker.exe Token: SeBackupPrivilege 3976 TiWorker.exe Token: SeRestorePrivilege 3976 TiWorker.exe Token: SeSecurityPrivilege 3976 TiWorker.exe Token: SeBackupPrivilege 3976 TiWorker.exe Token: SeRestorePrivilege 3976 TiWorker.exe Token: SeSecurityPrivilege 3976 TiWorker.exe Token: SeBackupPrivilege 3976 TiWorker.exe Token: SeRestorePrivilege 3976 TiWorker.exe Token: SeSecurityPrivilege 3976 TiWorker.exe Token: SeBackupPrivilege 3976 TiWorker.exe Token: SeRestorePrivilege 3976 TiWorker.exe Token: SeSecurityPrivilege 3976 TiWorker.exe Token: SeBackupPrivilege 3976 TiWorker.exe Token: SeRestorePrivilege 3976 TiWorker.exe Token: SeSecurityPrivilege 3976 TiWorker.exe Token: SeBackupPrivilege 3976 TiWorker.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3584 wrote to memory of 2524 3584 regsvr32.exe 82 PID 3584 wrote to memory of 2524 3584 regsvr32.exe 82 PID 3584 wrote to memory of 2524 3584 regsvr32.exe 82 PID 2524 wrote to memory of 1428 2524 regsvr32.exe 83 PID 2524 wrote to memory of 1428 2524 regsvr32.exe 83 PID 2524 wrote to memory of 1428 2524 regsvr32.exe 83
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_af13fc97525330c017e2a4785adff36aa66e70b3f400b540ad73e7190b8c7c2d_2022-02-08__000029.dll1⤵
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_af13fc97525330c017e2a4785adff36aa66e70b3f400b540ad73e7190b8c7c2d_2022-02-08__000029.dll2⤵
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_af13fc97525330c017e2a4785adff36aa66e70b3f400b540ad73e7190b8c7c2d_2022-02-08__000029.dll",DllRegisterServer3⤵PID:1428
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1152
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3976