Extracted

Extracted

Extracted

• • Target

    96532927739985571.xlsm

  • Size

    115KB

  • MD5

    383a3c7cdb5a9070656164e0b90e41a5

  • SHA1

    af0b4eedbd1c6d85705c26ebb3955f8b35a8cea8

  • SHA256

    c3f53e74cbc71cf1956d17dae939c2d9f31a1c2e81328a3ca88ceb1e3bf652c0

  • SHA512

    c37692e7c9a60fcda701450a620f09c0c95db6e6a1ee3188c2897d09a621d80e3f0fb539506f458ab5c20a7e5adc8adfbe2bcad0860c4bb9484f6292eb391b9c

  Score

  10^/10

  emotetepoch5bankertrojanpersistence

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2