emotet | 3b0180b4dd0f30d55d5ee0b79ffc251a0d1f043365cbaff6eeb9700e75164fbc

Analysis

Target
vblDG2.dll
Size 252KB
Sample211118-bzn1eaeea8
SHA256 3b0180b4dd0f30d55d5ee0b79ffc251a0d1f043365cbaff6eeb9700e75164fbc
MD5 d99833549b044be46de655829ba23525
SHA1 de2378d00166860165baccfec7486ae35ccbda1a
SHA512 f4647c50c1099d04f81b3a311c4f4a985a03d2dd9c3980720377225241b1b0468531455b16474c7a139efa6e22c35423ae72cd25e58a85a1c1cef898fd9aaa33
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	1320	rundll32.exe
6	1320	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1320	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 844	1900	rundll32.exe	27
PID 1900 wrote to memory of 844	1900	rundll32.exe	27
PID 1900 wrote to memory of 844	1900	rundll32.exe	27
PID 1900 wrote to memory of 844	1900	rundll32.exe	27
PID 1900 wrote to memory of 844	1900	rundll32.exe	27
PID 1900 wrote to memory of 844	1900	rundll32.exe	27
PID 1900 wrote to memory of 844	1900	rundll32.exe	27
PID 844 wrote to memory of 1320	844	rundll32.exe	29
PID 844 wrote to memory of 1320	844	rundll32.exe	29
PID 844 wrote to memory of 1320	844	rundll32.exe	29
PID 844 wrote to memory of 1320	844	rundll32.exe	29
PID 844 wrote to memory of 1320	844	rundll32.exe	29
PID 844 wrote to memory of 1320	844	rundll32.exe	29
PID 844 wrote to memory of 1320	844	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vblDG2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\vblDG2.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:844
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\vblDG2.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:1320

memory/844-56-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Download

memory/844-59-0x0000000010000000-0x0000000010028000-memory.dmp

Download