Overview

overview

10

Static

static

8

emotet_doc2

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    94e871e16d0a00448fc94b2fc941bf9d22f32b5e6045a4510ea331bf2ea9de3a

  • Size

    162KB

  • Sample

    201121-dm46phn22n

  • MD5

    f0a0b13e414ed5395fef8653e6816759

  • SHA1

    2f0fd598ddecd37b695a8558b69abe43af74afba

  • SHA256

    94e871e16d0a00448fc94b2fc941bf9d22f32b5e6045a4510ea331bf2ea9de3a

  • SHA512

    b364bb9043bf2661959955f1c830b534ed95c8e12296e4cb361b65f04ef7b690b80450853d1561c1a849ef66f816a198f5cca7986ce9db3ba1af652c50bb0582

Score
10/10
macro

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://vuatritue.com/wp-admin/w/
exe.dropper

http://castlestudios.com/bots/7/
exe.dropper

https://www.afriqueindustries-sa.com/ootqgtbgutgqkxfq/dS9/
exe.dropper

http://brandstrumpet-001-site1.ctempurl.com/default/lnD/
exe.dropper

http://oneinsix.com/test/u/
exe.dropper

http://livefarma.com/wp-content/hpu/
exe.dropper

http://datawyse.net/cgi-bin/8/

Targets

    • Target

      94e871e16d0a00448fc94b2fc941bf9d22f32b5e6045a4510ea331bf2ea9de3a

    • Size

      162KB

    • MD5

      f0a0b13e414ed5395fef8653e6816759

    • SHA1

      2f0fd598ddecd37b695a8558b69abe43af74afba

    • SHA256

      94e871e16d0a00448fc94b2fc941bf9d22f32b5e6045a4510ea331bf2ea9de3a

    • SHA512

      b364bb9043bf2661959955f1c830b534ed95c8e12296e4cb361b65f04ef7b690b80450853d1561c1a849ef66f816a198f5cca7986ce9db3ba1af652c50bb0582

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blacklisted process makes network request

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks