Extracted

• • Target
    IMQ_070120_TDS_072820.doc
  • Size 171KB
  • SHA256 0908f65f4fc6bbc55135748a1dc9f8120e504195f01caefafb80e6d7639f32c8
  • MD5 3542c52369bd722617d392642ce9a518
  • SHA1 7c7901a7c5f5e9367683062cf5fe82b5acb5185a
  • SHA512 0bc0f3ace06b5e4424918ccdc44f0d830cde0c4173fb59e4746b324f72dcf984ec83422487169df6e018e761601589815572760bc96b236562646ad543bc3c82
  • MD5 SHA1 SHA512

  Score

  10^/10

  discoverytrojanbankeremotet

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload

    Detects Emotet payload in memory.

  • Blacklisted process makes network request

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2