Extracted

• • Target
    865663204559_17_Nov_2021.xlsm
  • Size 44KB
  • SHA256 ee880ebdf26a1bcebe70a7ba17659199833c6107d758e26d37502bed9a225ee3
  • MD5 477fd718bb764ffe3c5afde16c6c8dd2
  • SHA1 eb932e19d95f88d64270d40cdc0b92c6d1cf63be
  • SHA512 f7d0451ca3670179cc93a680b99f8982204c43054c55eb479c38dc8ea0ba6ba5b6ebea4508569091c07d95a759841455605e6daeab445146b29fc1af377ba267
  • MD5 SHA1 SHA512

  Score

  10^/10

  emotetepoch4bankersuricatatrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)

    suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)

    suricata

  • suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1