Overview

overview

10

Static

static

8

emotet_doc2

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d2232dfab1a3d97b00285d3baeedaff80ee090c7fb8bec50f6fb23554fc7d4aa

  • Size

    157KB

  • Sample

    210113-9jsm5t94t6

  • MD5

    aa7e98010a10bc2406d352c565676199

  • SHA1

    2f8f65e6db91d0929e12d4008e7bcddde196e238

  • SHA256

    d2232dfab1a3d97b00285d3baeedaff80ee090c7fb8bec50f6fb23554fc7d4aa

  • SHA512

    f405323642171c7bf5b559d200cac09661f52e9c0dee84bd9e98e2f81d7d9fcc2784b47d94b03c218c39494ec522d4003a2d28989c93da80d17b76934c4dc42f

Score
10/10
macro

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://altrashift.com/wp-includes/I/
exe.dropper

https://ojodetigremezcal.com/wp/i62s/
exe.dropper

https://snowremoval-services.com/wp-content/P3Z/
exe.dropper

http://kitsunecomplements.com/too-much-phppq/n65U/
exe.dropper

https://imperioone.com/content/WOBq/
exe.dropper

http://www.autoeck-baden.at/wp-content/w0Vb/
exe.dropper

https://shop.animewho.com/content/Tj/

Targets

    • Target

      d2232dfab1a3d97b00285d3baeedaff80ee090c7fb8bec50f6fb23554fc7d4aa

    • Size

      157KB

    • MD5

      aa7e98010a10bc2406d352c565676199

    • SHA1

      2f8f65e6db91d0929e12d4008e7bcddde196e238

    • SHA256

      d2232dfab1a3d97b00285d3baeedaff80ee090c7fb8bec50f6fb23554fc7d4aa

    • SHA512

      f405323642171c7bf5b559d200cac09661f52e9c0dee84bd9e98e2f81d7d9fcc2784b47d94b03c218c39494ec522d4003a2d28989c93da80d17b76934c4dc42f

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks