Extracted

Extracted

Extracted

• • Target
    b7abd037919427beae6e7fdf5ce1d245
  • Size 142KB
  • SHA256 4e93c1dcd947587f5eafca098b66e47c5a20fe2106e01e044249c2ecf1087a69
  • MD5 b7abd037919427beae6e7fdf5ce1d245
  • SHA1 92a36edb3d3162f1b030b82c87ad0c698d4f147f
  • SHA512 a53fe5fdaf53881bf2499792a624973450570fae2b368a85565da8a6d252c7be2c493ddb0ff49c88bd14104ec0e5922ee665a5c4a505c928cb8837808600673e
  • MD5 SHA1 SHA512

  Score

  10^/10

  emotetepoch4bankersuricatatrojanredlineinfostealer

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2