Extracted

Extracted

Extracted

• • Target

    TC_9169.xlsm

  • Size

    49KB

  • MD5

    e3d5be98c00a8e3a8d203fa438324b43

  • SHA1

    e42871e45dd9b4f206ab53e5f6e26321dd27fe80

  • SHA256

    1bccdaed8a9d03e7c5a5f0ecd9ca25e942077d1be538087e6451cc3030e37b8d

  • SHA512

    98efd7fcad036d523e7c76e327deebbe5dcac4941d12a2a8961518bd2eaef5782d2211a1b9d99094633fa10d4360cc80dc6e4536474c5c6b21196a17f62aac5e

  Score

  10^/10

  emotetepoch5bankertrojanpersistence

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2