Extracted

Extracted

Extracted

• • Target
    9db324dc873d1b9f5d96ca9f242ccbce
  • Size 142KB
  • SHA256 b3973d991b4f3e3870404c40bf59257bd40f4207f10dd5a6c34a8d4e29e0f7ea
  • MD5 9db324dc873d1b9f5d96ca9f242ccbce
  • SHA1 9219af2794c0c4c3f3ec48cb1067db541372fdd5
  • SHA512 f9c76694a41cdcb7db854660b493696b2717757e0b16bb4672abce649d7f2ef3645394beb9a2444aca6a28e29e47dd6813ce24331d7866ac1c977d7fdc4b426f
  • MD5 SHA1 SHA512

  Score

  10^/10

  emotetepoch4bankersuricatatrojanpersistence

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2