emotet | 11d8e26021e20f61340a079530f4591612697ffb00988c22f5df8cf958a7739d

Analysis

Target
ttKaAp9mWzY3G91H.dll
Size 660KB
Sample220125-v6522scbf6
SHA256 11d8e26021e20f61340a079530f4591612697ffb00988c22f5df8cf958a7739d
MD5 60211b1ead706739cc31da56d2c76c10
SHA1 23f333c5df054da738e0d066bf25c305952e482a
SHA512 b289988867bae5a76ce090ab0f53232ff1b9a9b2085837c9155e9a1b19f6458ad8c755a56b72e7a0e77b03c902321de63bbba05a613037028fba95cdca639209
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1588	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1588	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1588	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1588	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1588	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1588	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1588	1636	regsvr32.exe	27
PID 1588 wrote to memory of 608	1588	regsvr32.exe	28
PID 1588 wrote to memory of 608	1588	regsvr32.exe	28
PID 1588 wrote to memory of 608	1588	regsvr32.exe	28
PID 1588 wrote to memory of 608	1588	regsvr32.exe	28
PID 1588 wrote to memory of 608	1588	regsvr32.exe	28
PID 1588 wrote to memory of 608	1588	regsvr32.exe	28
PID 1588 wrote to memory of 608	1588	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ttKaAp9mWzY3G91H.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ttKaAp9mWzY3G91H.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ttKaAp9mWzY3G91H.dll",DllRegisterServer
    3⤵
    PID:608

memory/1588-55-0x0000000075801000-0x0000000075803000-memory.dmp

Download

memory/1588-56-0x0000000000410000-0x0000000000435000-memory.dmp

Download

memory/1636-54-0x000007FEFC2D1000-0x000007FEFC2D3000-memory.dmp

Download