Extracted

Extracted

Extracted

• • Target

    QHB_677187.xlsm

  • Size

    112KB

  • MD5

    2f00a54638c5af4aa67c03f1d7ec12d0

  • SHA1

    23994a8656707b655417077ca79294dd5a82cf36

  • SHA256

    a0cc02185b718d8a8caec87fdee0f6aae676b61e1c69915cbd8d8e2600263b12

  • SHA512

    c50ae050b50fb210c640cdd014a211f1eae5b35ba25d2728f9bb6e726ca81b459e0d593a75bf7e20d5717c008d3b004da83f63a59e0ce1cdad4a826c59070220

  Score

  10^/10

  emotetepoch5bankersuricatatrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2