Extracted

Extracted

• • Target

    emotet_e2_fa59cf4c1af3d49c804914946132b59157e3d2f1eaf2d2d11a2ac0d5f2f3f2a9_2020-10-30__035315161430._doc

  • Size

    241KB

  • MD5

    10a666323e571710ab24832f3a81eebe

  • SHA1

    fb284f855928761abde54c850292425cf1872f77

  • SHA256

    fa59cf4c1af3d49c804914946132b59157e3d2f1eaf2d2d11a2ac0d5f2f3f2a9

  • SHA512

    77be1355f171be0aa1b1d07e924053c265aa302fb12d9b46e102491fd71c6d318575c72f86d4e05fcdc6436be275361cc8f18a6b1cf7500d2afb7620ef0e6f74

  Score

  10^/10

  emotetepoch2bankerdiscoverytrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload

    Detects Emotet payload in memory.

  • Blacklisted process makes network request

  • Executes dropped EXE

  • Modifies file permissions

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2