Extracted

Extracted

Extracted

• • Target
    898f8d42ad1155cf3f7c06028c3f6cc1
  • Size 141KB
  • SHA256 200e8c9ae00a3203aec36692f6a0a308dcc54d4b197115c599c678ebfaee3c18
  • MD5 898f8d42ad1155cf3f7c06028c3f6cc1
  • SHA1 27a325fa829b6ce5086a245b63b82c82c914f1ef
  • SHA512 bc243ee4cbc2aba17148fc93d96f64b6eaa09b4db71e68883123d35be097af0de453dd14d87476bc144a3333e7ca1584d94112d84125e872e23ffd279bb6e585
  • MD5 SHA1 SHA512

  Score

  10^/10

  emotetepoch4bankersuricatatrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2