Extracted

• • Target

    DOCUMENT_0316.one

  • Size

    117KB

  • MD5

    c7bc51b068bcc5f983fc44b2acdf7944

  • SHA1

    de0be1048b12dcaa49c295e72bb659ca14b45eab

  • SHA256

    b75681c1f99c4caf541478cc417ee9e8fba48f9b902c45d8bda0158a61ba1a2f

  • SHA512

    797fce6a6fe8fa29875dcfe05695c357daf23cec55a63ffe61418219997df65c2fec49b24985d79a0a16b000ffbdee5979dca1258482e2606101e7231cdcaf7f

  • SSDEEP

    1536:RDBoTVdaeNtuXndCrJJmT4HVnteV4FrdMiYcx7bfCb6HPdnXvv:1BoC+tCYvSMVnte8ZP1Y6Jfv

  Score

  10^/10

  emotetepoch4bankertrojanpersistence

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2