Overview

overview

10

Static

static

8

emotet_doc2

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a8ede5b4e9ad5f52a3c28142fa26a4c2caa2d9bd9e73aead41942d31986e4abe

  • Size

    91KB

  • Sample

    201108-tcnggtsn8a

  • MD5

    8ab1eb11519d5a556284d0e6d006b331

  • SHA1

    c4689ad2bd4082c3986c747ac25bfd9296097673

  • SHA256

    a8ede5b4e9ad5f52a3c28142fa26a4c2caa2d9bd9e73aead41942d31986e4abe

  • SHA512

    4c37f58286da386d51f66cc0033456bf76833ed33f8fd57949f767456f49b50769431a7ba413b0cec3260beb3d6f14fa3b6b54214841a21cfd53faa102752ab9

Score
10/10
macro

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://oushyn.com/efV5qsN/
exe.dropper

http://valentico.ru/fvxr/
exe.dropper

http://algia.com.ar/L4E6sc/
exe.dropper

http://klusmeier.de/s0UdPE/
exe.dropper

http://zazz.com.br/UIrE4e/

Targets

    • Target

      a8ede5b4e9ad5f52a3c28142fa26a4c2caa2d9bd9e73aead41942d31986e4abe

    • Size

      91KB

    • MD5

      8ab1eb11519d5a556284d0e6d006b331

    • SHA1

      c4689ad2bd4082c3986c747ac25bfd9296097673

    • SHA256

      a8ede5b4e9ad5f52a3c28142fa26a4c2caa2d9bd9e73aead41942d31986e4abe

    • SHA512

      4c37f58286da386d51f66cc0033456bf76833ed33f8fd57949f767456f49b50769431a7ba413b0cec3260beb3d6f14fa3b6b54214841a21cfd53faa102752ab9

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blacklisted process makes network request

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks