Extracted

Extracted

Extracted

• • Target
    477881ed20ef976c6dd8bef21a6cbb67
  • Size 142KB
  • SHA256 3d702c221263341fa14edf51b4d239cc665e2db56c4d1a7c5dbaa80065f182ec
  • MD5 477881ed20ef976c6dd8bef21a6cbb67
  • SHA1 920553b109bdf631776409ccf1ea4caf8aaee253
  • SHA512 a882ab619fe5d9fca8ca47a03456c9c87c7f2dfd38b31438f2293e22574c37e0218847d832657db71b88275e8899e7ccdf6a0389f44f74b5d54e978b311873ff
  • MD5 SHA1 SHA512

  Score

  10^/10

  emotetepoch4bankersuricatatrojanpersistence

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2