Extracted

• • Target

    Q_4992.xlsm

  • Size

    83KB

  • MD5

    597e9be00a6e6597e041ea986dac1252

  • SHA1

    ec554fff3d8d0d18de86a1def864340963afb925

  • SHA256

    eb3e8690d152148f0bc7d306065ba030410ba35eb5e672f09041b20cf000ee4f

  • SHA512

    6cb5570a2394704f0e30c8dc9cabec9b1b5451e5035f9c0532e74ff951bd824f02f943325d41dfd56a9de1b85b816d24182aa35f75062e736809d9fb06bc59cb

  Score

  10^/10

  suricata

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2