emotet | 9eb4a7a8e8762a3dc07cf709f1cf6abe9f2848ba3f9c04c3b7fb9858586ae68e

Analysis

max time kernel
92s
max time network
94s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
03-11-2022 08:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9eb4a7a8e8762a3dc07cf709f1cf6abe9f2848ba3f9c04c3b7fb9858586ae68e.dll
Size

818KB
MD5

7f9038e0a4b2f37ea84199b4229db719
SHA1

80c4c2c180bff96d25f9f225f7016ee9bbdf227e
SHA256

9eb4a7a8e8762a3dc07cf709f1cf6abe9f2848ba3f9c04c3b7fb9858586ae68e
SHA512

d4a5cb8e577a672f61683e10eaab9d8c7e2142c8a8a1e4a1e099bdd08f7c28283d87145c2f6e1fc472905e38ce407945ef4075993844ca783168beeeffa61948
SSDEEP

12288:NdewIvxiRO9n6DPBt9bu8X+L81JcZl1rNx48/2aS4/2YX:NYwIvxFMXn+L8zcZ7rvwC2Y

Score

10^/10

emotet banker persistence trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sFrYOQBLXNQ.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\LkqPXRfvmWtUuxrmb\\sFrYOQBLXNQ.dll\""	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2252	regsvr32.exe
2252	regsvr32.exe
1524	regsvr32.exe
1524	regsvr32.exe
1524	regsvr32.exe
1524	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2252	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 1524	2252	regsvr32.exe	67
PID 2252 wrote to memory of 1524	2252	regsvr32.exe	67

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9eb4a7a8e8762a3dc07cf709f1cf6abe9f2848ba3f9c04c3b7fb9858586ae68e.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\LkqPXRfvmWtUuxrmb\sFrYOQBLXNQ.dll"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:1524

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1524-121-0x0000000000000000-mapping.dmp

Download
memory/2252-116-0x0000000180000000-0x0000000180030000-memory.dmp

Filesize
192KB

Download