Extracted

Extracted

• • Target
    e1a7abda10e6b4c549c8869a00393488
  • Size 128KB
  • SHA256 5ae8846c8c7b641f282ee57e2c7e43ecbb26ef440b76a0fc3d4134df1c6e4867
  • MD5 e1a7abda10e6b4c549c8869a00393488
  • SHA1 700e62626fd4f2c0992037ccbdd2feb610c3fe5a
  • SHA512 a6ce48dc83fd98c122c0afbfa47f306e1a8ed9c7a953abe9c18297836f801d048916f1fea634bf181d1869bee8f1ba86713c9f9a9d04a7599853ee079b20fb77
  • MD5 SHA1 SHA512

  Score

  10^/10

  emotetbankersuricatatrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2