ba4d03e5f94c5bf30113d71b59256af87266e9ac0916f2782a915e207131d88a

General

Target

emotet_e2_ba4d03e5f94c5bf30113d71b59256af87266e9ac0916f2782a915e207131d88a_2021-01-12__220724635742._doc
Size

158KB
Sample

210112-bh6gkahgtn
MD5

6a8c3c7c18b3009bee05c8de13eae6c7
SHA1

973443fe63dff6dbf5684c7ac0bf5cd4d29bd34c
SHA256

ba4d03e5f94c5bf30113d71b59256af87266e9ac0916f2782a915e207131d88a
SHA512

7aabfde03c621a379d147bb3c4d37ee58853d363d83df40e31c18a45025176d29f03491b262536f59a0be9c5397ce78f5465b5c936be10d0af2e4b0b7b211310

Score

10^/10

macro

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://remediis.com/t/gm2X/

exe.dropper

http://avadnansahin.com/wp-includes/w/

exe.dropper

http://solicon.us/allam-cycle-1c4gn/f5z/

exe.dropper

http://www.riparazioni-radiotv.com/softaculous/DZz/

exe.dropper

http://www.agricampeggiocortecomotto.it/wp-admin/s7p1/

exe.dropper

https://www.starlingtechs.com/GNM/

exe.dropper

http://hellas-darmstadt.de/cgi-bin/ZSoo/

Targets

- Target
  
  emotet_e2_ba4d03e5f94c5bf30113d71b59256af87266e9ac0916f2782a915e207131d88a_2021-01-12__220724635742._doc
- Size
  
  158KB
- MD5
  
  6a8c3c7c18b3009bee05c8de13eae6c7
- SHA1
  
  973443fe63dff6dbf5684c7ac0bf5cd4d29bd34c
- SHA256
  
  ba4d03e5f94c5bf30113d71b59256af87266e9ac0916f2782a915e207131d88a
- SHA512
  
  7aabfde03c621a379d147bb3c4d37ee58853d363d83df40e31c18a45025176d29f03491b262536f59a0be9c5397ce78f5465b5c936be10d0af2e4b0b7b211310
Score

10^/10
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Process spawned unexpected child process

Blocklisted process makes network request

Loads dropped DLL

Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2