emotet | 603dbb3169c8044ce37937ea05ae454c348e47ef6bbc052f022062f6aff832aa | Triage™

Analysis

max time kernel
124s
max time network
126s
platform
windows10_x64
resource
win10-en-20211208
submitted
28/01/2022, 17:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zvb7uw.dll
Size 544KB
Sample220128-wkq7faabe8
SHA256 603dbb3169c8044ce37937ea05ae454c348e47ef6bbc052f022062f6aff832aa
MD5 08f7629d318f73e45a3e1f58808da8eb
SHA1 ff692406150390c314dc86a242ffb3f82c313226
SHA512 b10ad4c4278454c0851df778fef448b2e6232941750eec7c0a089690bf2061e80d3e8807534ddfd7cb070bd57f3959e7aeee5b139495ab267a35fe80408668dd
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 3556	2832	regsvr32.exe	68
PID 2832 wrote to memory of 3556	2832	regsvr32.exe	68
PID 2832 wrote to memory of 3556	2832	regsvr32.exe	68
PID 3556 wrote to memory of 1804	3556	regsvr32.exe	69
PID 3556 wrote to memory of 1804	3556	regsvr32.exe	69
PID 3556 wrote to memory of 1804	3556	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\zvb7uw.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\zvb7uw.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3556
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\zvb7uw.dll",DllRegisterServer
    3⤵
    PID:1804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3556-118-0x0000000004860000-0x0000000004887000-memory.dmp

Download