Extracted

Extracted

Extracted

• • Target

    PO 01212022.xls

  • Size

    69KB

  • MD5

    3a1495184751bb9daebf21f57c88896d

  • SHA1

    5aa023ed500a7f8b476c404b26e79a7600ecd3d6

  • SHA256

    2c9af469fcb89bb2e93d1ac70ce0bec912b78d5c3cbadccc3040c18dd03f5e41

  • SHA512

    738dee6362259030dafd18956535c5726a3e7bcb783392eb0b9fcc48dc76c6dad8fae675fc56262936847b75b92c2aecbda2c00f6c838eb084a45a027fa3a827

  Score

  10^/10

  emotetepoch4bankertrojan

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2