Extracted

Extracted

• • Target
    9fc640545dec191790137f95387ab640
  • Size 128KB
  • SHA256 01476eaa4b0f7bdde2a764be2f017d11e0a9743bdf0447c63288607ef7437ac1
  • MD5 9fc640545dec191790137f95387ab640
  • SHA1 a38f56b2068cc421e4e78c912e6da31049d9b07c
  • SHA512 24ac2f06f2d60bbb1e333c820271f7208dfeaa876828c899fc84167e7c56901ee2088c50f9b7733b29cf3c0504a51195cd87ea1c95fa29a30d51a19e82d64f44
  • MD5 SHA1 SHA512

  Score

  10^/10

  emotetbankersuricatatrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2