Extracted

• • Target

    8846_0.one

  • Size

    117KB

  • MD5

    b4d388fd8748c7a725541d8a53151a51

  • SHA1

    dc348918f86f3f96b8a508d9ab18788d20ae97d5

  • SHA256

    5697f2ac10e6f1a82497b6b8b19df905f77980ed0644ccd93d2e7bdbfd912241

  • SHA512

    410ab97d0d0fded07650287e4cc66eb9f54fa91ea1c0a8a1de57a723a11ae340de917549b85e7cd951249b58cf6aa213dc9f87e0af9f2dcf56e96abe1eb29439

  • SSDEEP

    1536:RDBoTVdaeNtuXndCrJJmT4HVnteV4FrdMiYcx7bfCb6HPdnXI:1BoC+tCYvSMVnte8ZP1Y6JY

  Score

  10^/10

  emotetepoch4bankertrojanpersistence

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2