Extracted

Extracted

• • Target
    a1a5f1d58cb7176ce30a3e4182332173
  • Size 128KB
  • SHA256 f93414304904cf04ee75d5594bbd6b17a29aeea92d9e719a3e53ae25e077c08a
  • MD5 a1a5f1d58cb7176ce30a3e4182332173
  • SHA1 7c891b4ea5beb022c44a0c576bb143cc764867ad
  • SHA512 5d4c8aea1f90984a9cbe7e934e8632db80a310accd9b35cf73ec1f6325618311585d0d5fa859bdd34fa7dcabf6391b5f35775ecd527fb4294fb6773d18c7c9df
  • MD5 SHA1 SHA512

  Score

  10^/10

  emotetbankersuricatatrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2