emotet | e8a150d1347a232e358448bfa2173f666c51770eae5b82919e7057c951ac0f05

Analysis

Target
FaGmyXg.dll
Size 512KB
Sample220127-vdd3vsgafk
SHA256 e8a150d1347a232e358448bfa2173f666c51770eae5b82919e7057c951ac0f05
MD5 de813b9f961c17b8d7e7b986e63ec7de
SHA1 33edec221b52ec6cfb3aa1fa5346759ef61eaa8f
SHA512 f597ad2f83e5f77195b958d35b5282b5937e92b50b7bf36d0f74c6f61fe4fb4877f6be035714124dd367d2d35bc82d21888b4dfb5bb2b09e1e4382dfe5193435
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 1100	1876	regsvr32.exe	27
PID 1876 wrote to memory of 1100	1876	regsvr32.exe	27
PID 1876 wrote to memory of 1100	1876	regsvr32.exe	27
PID 1876 wrote to memory of 1100	1876	regsvr32.exe	27
PID 1876 wrote to memory of 1100	1876	regsvr32.exe	27
PID 1876 wrote to memory of 1100	1876	regsvr32.exe	27
PID 1876 wrote to memory of 1100	1876	regsvr32.exe	27
PID 1100 wrote to memory of 672	1100	regsvr32.exe	28
PID 1100 wrote to memory of 672	1100	regsvr32.exe	28
PID 1100 wrote to memory of 672	1100	regsvr32.exe	28
PID 1100 wrote to memory of 672	1100	regsvr32.exe	28
PID 1100 wrote to memory of 672	1100	regsvr32.exe	28
PID 1100 wrote to memory of 672	1100	regsvr32.exe	28
PID 1100 wrote to memory of 672	1100	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\FaGmyXg.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\FaGmyXg.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\FaGmyXg.dll",DllRegisterServer
    3⤵
    PID:672

memory/1100-56-0x00000000760F1000-0x00000000760F3000-memory.dmp

Download

memory/1100-57-0x0000000000420000-0x0000000000445000-memory.dmp

Download

memory/1876-55-0x000007FEFBF81000-0x000007FEFBF83000-memory.dmp

Download