Overview

overview

10

Static

static

emotet_doc

windows7_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c892bc440d5444b162ce0d9b5255ec2e006a288563c30f1993cb3b7beaef98de.doc

  • Size

    193KB

  • Sample

    200315-l9cye2yxz6

  • MD5

    7a3a755a424048933a9040f7a6b17e6a

  • SHA1

    d6900fbe4164dbc3b697f466d5544d5d47173024

  • SHA256

    c892bc440d5444b162ce0d9b5255ec2e006a288563c30f1993cb3b7beaef98de

  • SHA512

    a96af6350e4d69bfdb731090321d31e6e6defdf5a95a7944064c485fb2f416f16d0c6de07f9324109cfb6b126090ec2fb89b916b7d400707613c637c2288bb98

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://ronakco.com/bin/f_an/
exe.dropper

http://clearcreeksportsclub.com/wp-content/O_c/
exe.dropper

http://vivasivo.com/wp-content/G_q/
exe.dropper

http://rinconadarolandovera.com/media/V_ii/
exe.dropper

http://logomunch.com/wp-content/Wz_nh/

Targets

    • Target

      c892bc440d5444b162ce0d9b5255ec2e006a288563c30f1993cb3b7beaef98de.doc

    • Size

      193KB

    • MD5

      7a3a755a424048933a9040f7a6b17e6a

    • SHA1

      d6900fbe4164dbc3b697f466d5544d5d47173024

    • SHA256

      c892bc440d5444b162ce0d9b5255ec2e006a288563c30f1993cb3b7beaef98de

    • SHA512

      a96af6350e4d69bfdb731090321d31e6e6defdf5a95a7944064c485fb2f416f16d0c6de07f9324109cfb6b126090ec2fb89b916b7d400707613c637c2288bb98

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blacklisted process makes network request

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Matrix

Tasks