Extracted

Extracted

Extracted

• • Target

    a-1665150.xlsm

  • Size

    115KB

  • MD5

    88646a07a6dfa5ad4701c778b50707a4

  • SHA1

    c406856081490e6b55bfebf099d9541bc400ac77

  • SHA256

    1b8a7503b95b685e1c29207ac2a9a9d75b188abfc9c492e670eb365377c1ad90

  • SHA512

    85c65de8396b5c8ae7e7bfd9f088bb001fef5f339c32c139fd86cc7ac5c822b80cabc2f7eff102c94b1ab9bfbab69afe013836f4c5b305a26852075c4393e85c

  Score

  10^/10

  emotetepoch5bankersuricatatrojanpersistence

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2