Extracted

• • Target
    4297929786N.xls
  • Size 118KB
  • SHA256 188d8ec1a7f87d4d0c195d54c5a581fedb58e49e31a5c8f5fe41f20e277bd9f9
  • MD5 363b347fe2a2b6742e30cdd35dd2096e
  • SHA1 027a917a462d9ffd51c08f56a3c51a58e9534a47
  • SHA512 d5f791f6c344640bb401f1984879e361c5d7544e164ab994ff6294394b03a5f87103d5818cd737668e492d9e4092639df639bd849bdc9e2c5321ec4fe5b56e1e
  • MD5 SHA1 SHA512

  Score

  10^/10

  emotetbankersuricatatrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2