Extracted

Extracted

Extracted

• • Target

    941152862708266.xls

  • Size

    128KB

  • MD5

    d0efc7a0b8673689b738de5d3d155e6d

  • SHA1

    66beb67d482a5de21d0a614abed203a4342158e8

  • SHA256

    554def5c6fb4917a17fb5f951fc799471eb7520dd970a47d62ad565642b281d6

  • SHA512

    26ae37022b3063230afe9ea64d459176f8256bd07152a04a25d7f729346a7a28c6a5ea3c313ef2ffdddc7a0e6bdb1dc686fabb25fad67e4b68a5b1fc6f99202a

  Score

  10^/10

  emotetepoch4bankersuricatatrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2