Overview

overview

10

Static

static

8

emotet_doc

windows7_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b8be31db3cf8fa74d86929a303a2ae714fb928211f14b777f4a63f2bd1854929.doc

  • Size

    84KB

  • Sample

    200315-ywnwdtnkfn

  • MD5

    43d2a3df73fdcb10b9429a480d96ddcf

  • SHA1

    806d56933c8bb8ec187c0da1be37424582b97801

  • SHA256

    b8be31db3cf8fa74d86929a303a2ae714fb928211f14b777f4a63f2bd1854929

  • SHA512

    f1443679436643c0177bfa1ab84b72293fa547c622382e03e4de198d13581c93bd854159e2f2e5ed901a6f35d47519c938de601edb0a345fe94252760167ce44

Score
10/10
macro

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://blog.bctianfu.cn/4
exe.dropper

http://mail.vcacademy.lk/5nLo
exe.dropper

http://lamemoria.in/2ib2Pt
exe.dropper

http://tropicalislandrealtyofflorida.com/NNqM7W
exe.dropper

http://businessarbitr.ru/E

Targets

    • Target

      b8be31db3cf8fa74d86929a303a2ae714fb928211f14b777f4a63f2bd1854929.doc

    • Size

      84KB

    • MD5

      43d2a3df73fdcb10b9429a480d96ddcf

    • SHA1

      806d56933c8bb8ec187c0da1be37424582b97801

    • SHA256

      b8be31db3cf8fa74d86929a303a2ae714fb928211f14b777f4a63f2bd1854929

    • SHA512

      f1443679436643c0177bfa1ab84b72293fa547c622382e03e4de198d13581c93bd854159e2f2e5ed901a6f35d47519c938de601edb0a345fe94252760167ce44

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blacklisted process makes network request

    • An obfuscated cmd.exe command-line is typically used to evade detection.

    behavioral1

MITRE ATT&CK Matrix

Tasks