Emotet-labelled sample’s launched child path also targeted by startup service
A sandbox report records a child executable running from a path also named by an automatic-start service setting, raising a persistence question without showing a service-triggered launch. Separately, a POST to a configured destination received an HTTP 404 response, showing an attempted exchange rather than a working command channel.
A Windows executable launched a child from C:\Windows\SysWOW64\wscproxystub\netfxperf.exe. In the same sandbox report, a service configuration pointed to that exact path and carried a start value associated with automatic startup. The combination raises a more consequential question than whether the file is malicious: was the child merely running once, or was its location also being prepared for persistent execution?
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read