Extracted

• • Target
    Invoice.docm
  • Size 139KB
  • SHA256 5b2e5a163c66cb3a906fb0e820f3695c7586d729a21a086fe9c82c69efaeb7e9
  • MD5 2e32bb218619f3918d83011838bc16ce
  • SHA1 bb4ad026d234942355261cb3b91e131ce08e72e1
  • SHA512 8f0092d6d0323e7a4e6cd99a2ecbee79562e5dcac92ab4cd0f6a12c74070a858ba1de1c628e38f99ef8e10b99e3814f6afea68df5522ced2b16efbf2e8dbb6e0
  • MD5 SHA1 SHA512

  Score

  10^/10

  emotetepoch4bankersuricatatrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)

    suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)

    suricata

  • suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2