emotet | d1daa0746a72e95372e0a959d4bfb73543e93ca49a38dc05466a53dbc1ff9290

Analysis

Target
eODEBAJuTHzGwtxbQH.dll
Size 258KB
Sample211209-q34ycsdebq
SHA256 d1daa0746a72e95372e0a959d4bfb73543e93ca49a38dc05466a53dbc1ff9290
MD5 bc92916dadd74b3fef9c227351e19d35
SHA1 233fbd3dc98cae3b391cf6933d0983a7261e2209
SHA512 feca4669290ff30f959523f381fc3ffe3bf537c32eb5cd5d730bbfb439afcb571003f0198a8e7d2d8779847fba4e1d1cb6519b59f55065ce5c59c5e642919686
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2448	2196	regsvr32.exe	68
PID 2196 wrote to memory of 2448	2196	regsvr32.exe	68
PID 2196 wrote to memory of 2448	2196	regsvr32.exe	68
PID 2448 wrote to memory of 2664	2448	regsvr32.exe	69
PID 2448 wrote to memory of 2664	2448	regsvr32.exe	69
PID 2448 wrote to memory of 2664	2448	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\eODEBAJuTHzGwtxbQH.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\eODEBAJuTHzGwtxbQH.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\eODEBAJuTHzGwtxbQH.dll",DllRegisterServer
    3⤵
    PID:2664

memory/2448-120-0x0000000010000000-0x0000000010025000-memory.dmp

Download