Extracted

Extracted

Extracted

• • Target

    4c047ff42c8f500cad96e6f884ba0d25

  • Size

    141KB

  • MD5

    4c047ff42c8f500cad96e6f884ba0d25

  • SHA1

    5654f7e7f9ba6fa83e372bb1eeafd6f446fd78df

  • SHA256

    9d1fb84bbcd977c6ff6a873b6485cf44af7d6562fa046b0b751dd1f6bfb2d31a

  • SHA512

    eef6aad4076f7698baa848cf32cff46a08125b9e8d06bdb8c3eaa8e886f3da22f3b56096abf16e9c09f34c5bfb43fb0f406aaab96c733574cd0de203716f6ce4

  Score

  10^/10

  emotetepoch4bankertrojanpersistence

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2