Extracted

Extracted

• • Target
    f403319e2d4811db7ed4abb114b225f9
  • Size 128KB
  • SHA256 5feb30d01fb35d5fde34eb531e533bbfe6870e26612f2b397214636aed65988d
  • MD5 f403319e2d4811db7ed4abb114b225f9
  • SHA1 7ae5484aba8579cef7daaf44c2ffd96679ea75fd
  • SHA512 ba99af441ee81b6216965ba0474fbe429b3c6d99f32fb18176997e8b95d75560e6d1461329d287ec7bbcd0ca91aea14738fc8d34c40a9f4115208c6bfeef4d20
  • MD5 SHA1 SHA512

  Score

  10^/10

  emotetbankersuricatatrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2