Extracted

• • Target

    2223475-67848.xlsm

  • Size

    83KB

  • MD5

    f0352504e6f4ba057a118715e6c5a174

  • SHA1

    d25bb13b4932f6a1882a036d9bfe9ea12372ee9c

  • SHA256

    c439e7909baca9d49b1a21ff8d6dd6b86d441ddd7bfd9d97cc7dde2238b821e2

  • SHA512

    294fa4fa698a7a92a9742507807c934be0bdcda69c22d89105f708b0f29a5b311e83ce88b673e5d65904f5af8002ed32b2bde8ded4be19280968d82d05207d97

  Score

  10^/10

  suricata

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2