General

  • Target

    18adcd70c08937ae09b02e2beda7f25810434ba411e54f62ca44c2bd0f51c7bb.doc

  • Size

    267KB

  • Sample

    200206-mbrxh85me6

  • MD5

    c3ad0c6d87120daddd73c38a5e98699e

  • SHA1

    2072e41d07893a3dd49d51a8d346f7778305b5d7

  • SHA256

    18adcd70c08937ae09b02e2beda7f25810434ba411e54f62ca44c2bd0f51c7bb

  • SHA512

    5cb46f7704e3cb87ee125e3466c3c621fd2cc237c262934290b608c7db1f02b6e002a71f560f39bd3f75fbf41dfc3a946fc5a84048c3adf132d25d39d787269c

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://inventionpva.com/new/d3d/

exe.dropper

http://gtdf.iseetaiwan.org/wp-content/ZZIfo190645/

exe.dropper

http://isd.iseetaiwan.org/wp-content/SUh5896/

exe.dropper

https://a2soft.ru/wp-content/plugins/check-email/Dd7t/

exe.dropper

https://www.itgrienehert.nl/wp-admin/wj4295/

Targets

    • Target

      18adcd70c08937ae09b02e2beda7f25810434ba411e54f62ca44c2bd0f51c7bb.doc

    • Size

      267KB

    • MD5

      c3ad0c6d87120daddd73c38a5e98699e

    • SHA1

      2072e41d07893a3dd49d51a8d346f7778305b5d7

    • SHA256

      18adcd70c08937ae09b02e2beda7f25810434ba411e54f62ca44c2bd0f51c7bb

    • SHA512

      5cb46f7704e3cb87ee125e3466c3c621fd2cc237c262934290b608c7db1f02b6e002a71f560f39bd3f75fbf41dfc3a946fc5a84048c3adf132d25d39d787269c

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails

    • Process spawned unexpected child process

    • Blacklisted process makes network request

    • Executes dropped EXE

    • Drops file in System32 directory

MITRE ATT&CK Matrix

Tasks