Overview

overview

10

Static

static

8

DOC_PO_07282020EX.doc

windows7_x64

10

DOC_PO_07282020EX.doc

windows10_x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    DOC_PO_07282020EX.doc
  • Size 169KB
  • Sample200728-t2441568qj
  • SHA256 20d81ffc64ba89a114dc4ee30c643d555945ab0ec0f3a17c96b56d6087ef3b13
  • MD5 SHA1 SHA512
Score
10/10
emotetbankerdiscoverymacrotrojan

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://www.ramms.com.au/fodico/it_na0x8_nykhe/
  • exe.dropper

    http://stcswim.com/tj_fk_6/
  • exe.dropper

    http://smdcomputers.com/libraries/3tv_vzx_z3g/
  • exe.dropper

    http://jenerationz.com/icon/os/css/4ekl8_lwj_c6d0/
  • exe.dropper

    http://henney.net/misc/exl_x_f6p8tnz/

Targets

    • Target
      DOC_PO_07282020EX.doc
    • Size 169KB
    • SHA256 20d81ffc64ba89a114dc4ee30c643d555945ab0ec0f3a17c96b56d6087ef3b13
    • MD5 SHA1 SHA512
    Score
    10/10
    discoverytrojanbankeremotet

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Emotet Payload

      Detects Emotet payload in memory.

    • Blacklisted process makes network request

    • Executes dropped EXE

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks