Extracted

Extracted

• • Target

    efe94cedd53de019cc10da7939e5ea9a62de62e66cb917b3d2ffcc8f2fba969d

  • Size

    83KB

  • MD5

    8a6933b776b90c3e5610c67d12f51f79

  • SHA1

    5656531bdbe27bfec2fc8b51047127e50e033ebe

  • SHA256

    efe94cedd53de019cc10da7939e5ea9a62de62e66cb917b3d2ffcc8f2fba969d

  • SHA512

    c93f25f3d387e6dc3fd503553de7795ee6b09e9b1d5e911174fd5c13a9ba3a862fa88d0f19f7444077992ef51af433f71a5df3b30dd9710ce9f8f2d64aee3135

  Score

  10^/10

  suricata

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2