Overview

overview

10

task1

 

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    84e1f44b45c2718ca9b16514392e63f9818133b90afcab40ede169f0ad7185ae.doc

  • Size

    265KB

  • Sample

    200206-k56qkxljzs

  • MD5

    341b8e448b96443e787c9beed226ce0d

  • SHA1

    bfc8f853b2100e98bb4d5cc17adfcd6c05c30c11

  • SHA256

    84e1f44b45c2718ca9b16514392e63f9818133b90afcab40ede169f0ad7185ae

  • SHA512

    63096648c99b5b2978ca17539f771a943a6457718525e3d186a69ee48f320fa520c59caf92aef4877e6059ae69f93ad2e2d77294bcea1057a96c40cad3c467a6

Score
10/10
emotetbankertrojan

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://supcargo.com/Login/K/
exe.dropper

http://sunucuo.com/wp-admin/0V0e/
exe.dropper

http://sweetestshop.ca/wp/3ca5oq/
exe.dropper

http://subhedarmarketing.com/2/7gtTEM8/
exe.dropper

http://takharandshankertour.com/wp-includes/IXR/2/

Targets

    • Target

      84e1f44b45c2718ca9b16514392e63f9818133b90afcab40ede169f0ad7185ae.doc

    • Size

      265KB

    • MD5

      341b8e448b96443e787c9beed226ce0d

    • SHA1

      bfc8f853b2100e98bb4d5cc17adfcd6c05c30c11

    • SHA256

      84e1f44b45c2718ca9b16514392e63f9818133b90afcab40ede169f0ad7185ae

    • SHA512

      63096648c99b5b2978ca17539f771a943a6457718525e3d186a69ee48f320fa520c59caf92aef4877e6059ae69f93ad2e2d77294bcea1057a96c40cad3c467a6

    Score
    10/10
    trojanbankeremotet

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails

      trojanbankeremotet

    • Process spawned unexpected child process

    • Blacklisted process makes network request

    • Executes dropped EXE

    • Drops file in System32 directory

    task1

MITRE ATT&CK Matrix

Tasks