Overview

overview

10

Static

static

8

emotet_e1_...px.doc

windows7_x64

10

emotet_e1_...px.doc

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    emotet_e1_b6830a87d4b0190a7ab22d5f1e81bb4cd42a8a746e5ca60104304cfac33066aa_2020-10-28__161510036749._fpx
  • Size 267KB
  • Sample201028-xp2lxsyamn
  • SHA256 b6830a87d4b0190a7ab22d5f1e81bb4cd42a8a746e5ca60104304cfac33066aa
  • MD5 SHA1 SHA512
Score
10/10
macro

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://www.leapmom.com/ukeol/c/
  • exe.dropper

    https://csgcargo.com/wp-content/d/
  • exe.dropper

    https://www.greenleafnaturalfarms.com/cgi-bin/h/
  • exe.dropper

    https://rucloset.com/gon/4/
  • exe.dropper

    https://pachiba.com/blogs/7/
  • exe.dropper

    https://betsdotbahisgiris.com/cgi-bin/I/
  • exe.dropper

    https://rawmeditations.com/wp-content/r/

Targets

    • Target
      emotet_e1_b6830a87d4b0190a7ab22d5f1e81bb4cd42a8a746e5ca60104304cfac33066aa_2020-10-28__161510036749._fpx
    • Size 267KB
    • SHA256 b6830a87d4b0190a7ab22d5f1e81bb4cd42a8a746e5ca60104304cfac33066aa
    • MD5 SHA1 SHA512
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blacklisted process makes network request

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks