Extracted

Extracted

• • Target

    88b9aa3c90a28ecdd7adf28ea12e316d3b2c8a7086d315f97a2e62a77abd49af.doc

  • Size

    170KB

  • MD5

    f49b4d134476d19dcc417036db84d5ed

  • SHA1

    076fe5d8a16d8cb7e4d17d8a059997f67da3b2c4

  • SHA256

    88b9aa3c90a28ecdd7adf28ea12e316d3b2c8a7086d315f97a2e62a77abd49af

  • SHA512

    ce5f69bd2ae45198aa8bb37b2a1d1b4fe0a63075b8faf57f6856eb368e825b8f0b45488a9a6ceb4dc1df1db6a051a60b5694cecce75433c3077071418c8499f9

  Score

  10^/10

  trojanbankeremotet

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload

    Detects Emotet payload in memory.

  • Blacklisted process makes network request

  • Executes dropped EXE

  • Drops file in System32 directory

  behavioral1