Overview

overview

10

Static

static

8

emotet_e2_...oc.doc

windows7_x64

10

emotet_e2_...oc.doc

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    emotet_e2_0cc941f700b9a29f40bca3fe91fec9cf249a54298b419521d147c0ca64ceb8e9_2020-08-18__124035._doc
  • Size 175KB
  • Sample200818-th7egbcqks
  • SHA256 0cc941f700b9a29f40bca3fe91fec9cf249a54298b419521d147c0ca64ceb8e9
  • MD5 SHA1 SHA512
Score
10/10
macro

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://52550750-56-20180826151453.webstarterz.com/savewayexpressthai.com/jnze_2o3j_k/
  • exe.dropper

    http://oubaina.com/wp-includes/lqkz_nvr_1avf4/
  • exe.dropper

    https://www.msbc.kz/data/k527_5_cbdvv5bi19/
  • exe.dropper

    http://okcupidating.com/im/fsq_esj_qgx060p/
  • exe.dropper

    http://bike-nomad.com/cgi-bin/7n_0x0_62mnzyh9q/

Targets

    • Target
      emotet_e2_0cc941f700b9a29f40bca3fe91fec9cf249a54298b419521d147c0ca64ceb8e9_2020-08-18__124035._doc
    • Size 175KB
    • SHA256 0cc941f700b9a29f40bca3fe91fec9cf249a54298b419521d147c0ca64ceb8e9
    • MD5 SHA1 SHA512
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blacklisted process makes network request

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks