Overview

overview

10

task1

 

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a8c2484e46608a21dfeeff1ab85c6bf46bdf1322017201ce053086e9aedc663c.doc

  • Size

    259KB

  • Sample

    200205-pbx9p3jwm6

  • MD5

    38e43efd8171cd10ca890b91f07e9592

  • SHA1

    3579c9b75c2c556e6d3636f498ea78075a3c9c6a

  • SHA256

    a8c2484e46608a21dfeeff1ab85c6bf46bdf1322017201ce053086e9aedc663c

  • SHA512

    f44542fc2a2b27edafefc34a9aa4bcb71970a6bf9f9c4d68f39eaf22e53162252f6df0652ec0125f84c28523c59409cd735b5348ef5ef897fb2889f5355e4bd5

Score
10/10
emotetbankertrojan

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://alwaysonq.com/web_map/UkwFMlO/
exe.dropper

http://norbert.strzelecki.org/wp-includes/6jGh/
exe.dropper

http://bieres.lavachenoiresud.com/wp-includes/0wycYTX/
exe.dropper

https://theresurrectionchurch.nl/tmp/eo5st/
exe.dropper

https://tahfizbd.com/wp-admin/ulu/

Targets

    • Target

      a8c2484e46608a21dfeeff1ab85c6bf46bdf1322017201ce053086e9aedc663c.doc

    • Size

      259KB

    • MD5

      38e43efd8171cd10ca890b91f07e9592

    • SHA1

      3579c9b75c2c556e6d3636f498ea78075a3c9c6a

    • SHA256

      a8c2484e46608a21dfeeff1ab85c6bf46bdf1322017201ce053086e9aedc663c

    • SHA512

      f44542fc2a2b27edafefc34a9aa4bcb71970a6bf9f9c4d68f39eaf22e53162252f6df0652ec0125f84c28523c59409cd735b5348ef5ef897fb2889f5355e4bd5

    Score
    10/10
    trojanbankeremotet

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails

      trojanbankeremotet

    • Process spawned unexpected child process

    • Blacklisted process makes network request

    • Executes dropped EXE

    • Drops file in System32 directory

    task1

MITRE ATT&CK Matrix

Tasks