Extracted

Extracted

Extracted

• • Target

    1006816642751381445.xls

  • Size

    71KB

  • MD5

    fad5c85a9115f2c85fdcf41bdaa3d0e7

  • SHA1

    09c9d0b3d06560b7a8b55076d11ac27a535375ab

  • SHA256

    67d5e8d2c3fcf5a17f0c7aad1b6f8963102dd00bdb62a3179605c3cdf659ab3c

  • SHA512

    98406cddadedc929c165059a30320e28b9278f9c8a5d79941104a43bfc99c5926f7ecd8b47aa9a39b361167767c57ae9dba6787e554480183aaedab21323a99b

  Score

  10^/10

  emotetepoch4bankertrojanpersistence

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Sets service image path in registry

    persistence

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2