emotet | 49c11dee62a2e56058b0a1b4bdcd8e02c93e33ea58904bfac3f489fbea51fe44

Analysis

max time kernel
70s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/11/2022, 01:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
72599fcdbe9142ad3c3f226eb781dd2b.dll
Size 727KB
Sample221103-blm6ysdcg3
SHA256 49c11dee62a2e56058b0a1b4bdcd8e02c93e33ea58904bfac3f489fbea51fe44
MD5 72599fcdbe9142ad3c3f226eb781dd2b
SHA1 b2d72c538d1d9bebfd8dbe9004c7dd57eb7f26f8
SHA512 6b15669d46c8ce3fbe0ffb001aa345d09f515bc8820aa8118ade23827cf7560199ca7e47e740a08b8402d988b1fe42a48c7709b17aa30cd0a608c44884b3ff28
SSDEEP 12288:ezhsu7PWe6Fth9tmzQS+37pzGIz/mXpo1z+ISjq+DsCJqzfo:ktR6rhjmzhsT/Yg69jtJqzf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

emotet banker persistence trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KeYGnlESE.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\UInEQBEZycdPnrT\\KeYGnlESE.dll\""	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
900	regsvr32.exe
900	regsvr32.exe
1332	regsvr32.exe
1332	regsvr32.exe
1332	regsvr32.exe
1332	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
900	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 1332	900	regsvr32.exe	79
PID 900 wrote to memory of 1332	900	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\72599fcdbe9142ad3c3f226eb781dd2b.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\UInEQBEZycdPnrT\KeYGnlESE.dll"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:1332

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-132-0x0000000180000000-0x0000000180030000-memory.dmp

Download