emotet | acfe35fbc39418fdd1bf10122f8a4e65dca7c035984856499b1ab18277a8c6a7

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
19-05-2024 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

zzxcQbq.exe
Size

154KB
MD5

341c10bdaacaf6ce8597010686e32774
SHA1

bd540adcc2c0a42d552c54a09d0deac5bc81268e
SHA256

8c960c48df52fd6aab7d06567b6b09c1bdad0b8c84b1e7fe1e70eefa3b91869c
SHA512

a8b3a1445c044f8aac97f248833a9fb303f60c9aa83f371f870a4cb17c4562afbe803f990608a20964c4bada42c1ea91100e66a4cee8409ae0a77d174cb46ddc
SSDEEP

3072:6RVim8g8jfIKdZY/VFhINLijAHoTC0fmxS9IAxzspOs:6yM8jFm/VrINL7G7CAm

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

zzxcQbq.exezzxcQbq.exe

pid process

1804 zzxcQbq.exe
2264 zzxcQbq.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

zzxcQbq.exe

pid process

2264 zzxcQbq.exe

pid	process
1804	zzxcQbq.exe
2264	zzxcQbq.exe

pid	process
2264	zzxcQbq.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

zzxcQbq.exe

description	pid	process	target process
PID 1804 wrote to memory of 2264	1804	zzxcQbq.exe	zzxcQbq.exe
PID 1804 wrote to memory of 2264	1804	zzxcQbq.exe	zzxcQbq.exe
PID 1804 wrote to memory of 2264	1804	zzxcQbq.exe	zzxcQbq.exe
PID 1804 wrote to memory of 2264	1804	zzxcQbq.exe	zzxcQbq.exe

C:\Users\Admin\AppData\Local\Temp\zzxcQbq.exe
"C:\Users\Admin\AppData\Local\Temp\zzxcQbq.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1804

C:\Users\Admin\AppData\Local\Temp\zzxcQbq.exe
"C:\Users\Admin\AppData\Local\Temp\zzxcQbq.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:2264

C:\Windows\SysWOW64\montanainitial.exe
"C:\Windows\SysWOW64\montanainitial.exe"
1⤵
PID:1116

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1804-4-0x0000000000310000-0x0000000000327000-memory.dmp

Filesize
92KB

Download
memory/1804-0-0x0000000000310000-0x0000000000327000-memory.dmp

Filesize
92KB

Download
memory/1804-6-0x00000000002C0000-0x00000000002D0000-memory.dmp

Filesize
64KB

Download
memory/1804-5-0x00000000002A0000-0x00000000002B7000-memory.dmp

Filesize
92KB

Download
memory/1804-14-0x00000000002A0000-0x00000000002B7000-memory.dmp

Filesize
92KB

Download
memory/2264-12-0x0000000000390000-0x00000000003A7000-memory.dmp

Filesize
92KB

Download
memory/2264-8-0x0000000000390000-0x00000000003A7000-memory.dmp

Filesize
92KB

Download
memory/2264-7-0x0000000000370000-0x0000000000387000-memory.dmp

Filesize
92KB

Download
memory/2264-13-0x00000000002B0000-0x00000000002C0000-memory.dmp

Filesize
64KB

Download
memory/2264-15-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2264-17-0x0000000000370000-0x0000000000387000-memory.dmp

Filesize
92KB

Download
memory/2264-19-0x0000000000370000-0x0000000000387000-memory.dmp

Filesize
92KB

Download