Extracted

Extracted

Extracted

• • Target
    5a6ac3a9701c7c5323d774b4dda7cc4f
  • Size 71KB
  • SHA256 9ad38c251b929edaf974d16b81d02e8b87ca16da14c4aa4eea44df09aa210c69
  • MD5 5a6ac3a9701c7c5323d774b4dda7cc4f
  • SHA1 40e7a5e7b6aebc9d738c63e618444f70531df834
  • SHA512 6df383f180d6e6eab5c590af29f3af0e72393a13aff04f01d7e9a05ba16e2339006123eaac750873317c8b7aca4e7808a72d57cee43db3ad91608b5066f8eb8a
  • MD5 SHA1 SHA512

  Score

  10^/10

  emotetepoch4bankersuricatatrojanpersistence

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2