Overview

overview

8

Static

static

Emotet (1).rtf

windows7_x64

8

Emotet (1).rtf

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Emotet (1)

  • Size

    1.7MB

  • Sample

    200713-dnllxa8bt6

  • MD5

    7e461f6366681c5ae24920a31c3cfec6

  • SHA1

    3513d238a659d27f1ff3acea55e84fafa093c676

  • SHA256

    98af6635138045cae3f29995a587d0c8a7f14446a9d10564677dd4a41372c3f1

  • SHA512

    2b34fd033faf6e68188ddc3fffd73b3a22bff0545e4464c5017573392adb2d46533249b4c20b21ef53dab9899429deb0fff70f65e859c47a33e702c6162b2743

Score
8/10
persistence

Malware Config

Targets

    • Target

      Emotet (1)

    • Size

      1.7MB

    • MD5

      7e461f6366681c5ae24920a31c3cfec6

    • SHA1

      3513d238a659d27f1ff3acea55e84fafa093c676

    • SHA256

      98af6635138045cae3f29995a587d0c8a7f14446a9d10564677dd4a41372c3f1

    • SHA512

      2b34fd033faf6e68188ddc3fffd73b3a22bff0545e4464c5017573392adb2d46533249b4c20b21ef53dab9899429deb0fff70f65e859c47a33e702c6162b2743

    Score
    8/10
    persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run entry to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Exploitation for Client Execution

1
T1203

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks