Extracted

Extracted

Extracted

• • Target
    eaa97dd2f51e218ca3743ffddab4451a
  • Size 141KB
  • SHA256 2e1ea41b40eda483558b5bb13f493c45a97d3c19214d9b1f11198ef25976d4f4
  • MD5 eaa97dd2f51e218ca3743ffddab4451a
  • SHA1 c46c98d8d78b772f4168ca61924ed117cf4f67de
  • SHA512 bceac011d0d3f4d3209434ad32d410be4e0636def02454a65d0ea2c7ceb57521ad4a47d0a96de6ee4b56b2bcac837a2f214e049e36d674754bd7967033fd9417
  • MD5 SHA1 SHA512

  Score

  10^/10

  emotetepoch4bankersuricatatrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2