Overview

overview

10

Static

static

8

emotet_doc

windows7_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cfaee36e547a4959920ce7ae59ca4b22e30a66ec4a27badfd23346d44145d343.doc

  • Size

    170KB

  • Sample

    200729-5latqv6dn2

  • MD5

    88ebfd9443e1b48faf331a4a6d798034

  • SHA1

    a70f039f3ee98260c1a4e47cf17252c1b8efb7a9

  • SHA256

    cfaee36e547a4959920ce7ae59ca4b22e30a66ec4a27badfd23346d44145d343

  • SHA512

    ed924244367640860c4126154367374ec137d55511619fa5fc63ef99aabd933e816ee7f590c24a0ea8109cc8f37d6ebad0663c0be626d3b537612499350d3ced

Score
10/10
macro

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://meuambientedecoracoes.com.br/update/ux5_iq061_x7f/
exe.dropper

http://dogbluemedia.com/dbm-salon/1g_9s_98t0/
exe.dropper

http://enhancementtechnology.co.uk/wp-includes/w0r_c6_zy8an/
exe.dropper

https://firstaid-redliv.dk/wp-content/c_zjmm_0p7xzukpo9/
exe.dropper

http://firman.com.au/fq_cze_gakl53z/

Targets

    • Target

      cfaee36e547a4959920ce7ae59ca4b22e30a66ec4a27badfd23346d44145d343.doc

    • Size

      170KB

    • MD5

      88ebfd9443e1b48faf331a4a6d798034

    • SHA1

      a70f039f3ee98260c1a4e47cf17252c1b8efb7a9

    • SHA256

      cfaee36e547a4959920ce7ae59ca4b22e30a66ec4a27badfd23346d44145d343

    • SHA512

      ed924244367640860c4126154367374ec137d55511619fa5fc63ef99aabd933e816ee7f590c24a0ea8109cc8f37d6ebad0663c0be626d3b537612499350d3ced

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blacklisted process makes network request

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Matrix

Tasks