Overview

overview

10

task1

 

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ab438367b318279539c2a0063535694b1f6484dc38869b282cd1c8e06d247abd.doc

  • Size

    129KB

  • Sample

    200204-3ywhsqkqn6

  • MD5

    fd7a4494d274b8920c6706a7d2a33ce0

  • SHA1

    160e0796e641ea058240139588a6fa0c3170a964

  • SHA256

    ab438367b318279539c2a0063535694b1f6484dc38869b282cd1c8e06d247abd

  • SHA512

    363b91cd7abf92cd52f7d1b94fa3ee3540144ab162d9b0813bcf7759545ce934461e03e89f83cebfeab33348a71459ab197cdfe09bdbcdc1a1c740ca49e806dc

Score
10/10
emotetbankertrojan

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://medical.hsh-bh.com/wp-admin/4xmE1404/
exe.dropper

https://elifehotel.com/cgi-bin/hzdXtyh/
exe.dropper

http://ceylongems.konektholdings.com/test/f01D/
exe.dropper

https://bankingdb.com/blog/eA/
exe.dropper

http://modahub.site/wp-admin/Ccq569913/

Targets

    • Target

      ab438367b318279539c2a0063535694b1f6484dc38869b282cd1c8e06d247abd.doc

    • Size

      129KB

    • MD5

      fd7a4494d274b8920c6706a7d2a33ce0

    • SHA1

      160e0796e641ea058240139588a6fa0c3170a964

    • SHA256

      ab438367b318279539c2a0063535694b1f6484dc38869b282cd1c8e06d247abd

    • SHA512

      363b91cd7abf92cd52f7d1b94fa3ee3540144ab162d9b0813bcf7759545ce934461e03e89f83cebfeab33348a71459ab197cdfe09bdbcdc1a1c740ca49e806dc

    Score
    10/10
    trojanbankeremotet

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails

      trojanbankeremotet

    • Process spawned unexpected child process

    • Blacklisted process makes network request

    • Executes dropped EXE

    • Drops file in System32 directory

    task1

MITRE ATT&CK Matrix

Tasks