Extracted

• • Target
    BAL_95272688616.doc
  • Size 171KB
  • SHA256 8a02a02bf39b80d809da634fe105c29a2b012acfa59c4eaedd94360fb5fbd2e3
  • MD5 1281905d428034da9169ad1652535f39
  • SHA1 94043f69d7304a7f1bff3b846cd0a315f8cce78d
  • SHA512 dbbaa480dea04fcd8e8bd2e4402840d2201a67f5db930920076d2560929181dbaa921e7c7033203e23ee84466277cc0bcdfbbe12291f5848e99a000c403bf658
  • MD5 SHA1 SHA512

  Score

  10^/10

  discoverytrojanbankeremotet

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload

    Detects Emotet payload in memory.

  • Blacklisted process makes network request

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2