Extracted

• • Target
    749464045419330.doc
  • Size 171KB
  • SHA256 26906041efdeafb6c1754eac8dff97abf079148816f1121ef92bfaed0a6e9991
  • MD5 5f33f6ae2eb0cf4f6f33e7aefb7ef452
  • SHA1 b8072688f1ae53ab1cdf7108d6425c9ade4dfdd4
  • SHA512 51af02cc3f94b6bb72c4602aa1a94c1fae03314914345dd279f388c4e0e530bf47f444026ee2ed1086b42a82d8372d7a3d770a29474f87d52993609b370f59f9
  • MD5 SHA1 SHA512

  Score

  10^/10

  discoverytrojanbankeremotet

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload

    Detects Emotet payload in memory.

  • Blacklisted process makes network request

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2