Extracted

• • Target
    SRT_070120_YUZ_072820.doc
  • Size 169KB
  • SHA256 fa0ce8c142463b37579d0d5a4fbb8da9dde5081ce2d5ffe0303872a533e7e190
  • MD5 29828e466860a2972c4ce074d71348a0
  • SHA1 815f96c75289ea3ec8862beaadc35a30d6551c03
  • SHA512 d82916d1b026da8c4d49ea73262f6055a66ae716e6a71eb3a79d94c72416b0c367a502ea4a6452ba94ea05dad00c2f1787009da1dd647ffc70536e6c703e04d0
  • MD5 SHA1 SHA512

  Score

  10^/10

  discoverytrojanbankeremotet

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload

    Detects Emotet payload in memory.

  • Blacklisted process makes network request

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2