General

  • Target

    ba1ad7a3f3d3f24d4862ca8b73df68f7e30f04153cc87040d51e2943af746c09.doc

  • Size

    128KB

  • Sample

    200204-nbm656ce3a

  • MD5

    63246869fc3b2be6fe6298f5276feb49

  • SHA1

    664a627dc70645aeec030cfff2b8db5472191899

  • SHA256

    ba1ad7a3f3d3f24d4862ca8b73df68f7e30f04153cc87040d51e2943af746c09

  • SHA512

    719fa054b4b830a16b9164f3ee7b89288697a1f61ad16d9fee729e7aed57da004ecdb3581dc079e2c048f92b8e2df5694a35bc873d1b23056e38f8af6a11e517

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://www.trinomulkantho.com/fkejsh742jdhed/uvb/

exe.dropper

http://40ad.com/wp-admin/jktqs/

exe.dropper

http://bestdiyprojects.info/wp-admin/GI/

exe.dropper

https://zetalogs.com/wp-includes/UUO2l9rLzB/

exe.dropper

https://beleze.com.br/social/KHp2ow/

Targets

    • Target

      ba1ad7a3f3d3f24d4862ca8b73df68f7e30f04153cc87040d51e2943af746c09.doc

    • Size

      128KB

    • MD5

      63246869fc3b2be6fe6298f5276feb49

    • SHA1

      664a627dc70645aeec030cfff2b8db5472191899

    • SHA256

      ba1ad7a3f3d3f24d4862ca8b73df68f7e30f04153cc87040d51e2943af746c09

    • SHA512

      719fa054b4b830a16b9164f3ee7b89288697a1f61ad16d9fee729e7aed57da004ecdb3581dc079e2c048f92b8e2df5694a35bc873d1b23056e38f8af6a11e517

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails

    • Process spawned unexpected child process

    • Blacklisted process makes network request

    • Executes dropped EXE

    • Drops file in System32 directory

MITRE ATT&CK Matrix

Tasks