Overview

overview

10

Static

static

8

emotet_e2_...oc.doc

windows7_x64

10

emotet_e2_...oc.doc

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    emotet_e2_2ca474c61c439d6ec322184ebdd33ccc28bcf529017a60caf587861aed611734_2021-01-13__042519204767._doc

  • Size

    157KB

  • Sample

    210113-j8aqkbcezs

  • MD5

    badf65526f2c6cbb684001e5cd0772c0

  • SHA1

    8207dde18701d398c3b34c2bba7e7e54862a1c56

  • SHA256

    2ca474c61c439d6ec322184ebdd33ccc28bcf529017a60caf587861aed611734

  • SHA512

    5f6ee227b873d4143bb693c094f4c34b23fd99f52a632df00c9d70d7a5a30d6c2764ccec0fd637da923071a3f9010dad71ab7c5beff75e5858ef8f8e2084d2c9

Score
10/10
macro

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://altrashift.com/wp-includes/I/
exe.dropper

https://ojodetigremezcal.com/wp/i62s/
exe.dropper

https://snowremoval-services.com/wp-content/P3Z/
exe.dropper

http://kitsunecomplements.com/too-much-phppq/n65U/
exe.dropper

https://imperioone.com/content/WOBq/
exe.dropper

http://www.autoeck-baden.at/wp-content/w0Vb/
exe.dropper

https://shop.animewho.com/content/Tj/

Targets

    • Target

      emotet_e2_2ca474c61c439d6ec322184ebdd33ccc28bcf529017a60caf587861aed611734_2021-01-13__042519204767._doc

    • Size

      157KB

    • MD5

      badf65526f2c6cbb684001e5cd0772c0

    • SHA1

      8207dde18701d398c3b34c2bba7e7e54862a1c56

    • SHA256

      2ca474c61c439d6ec322184ebdd33ccc28bcf529017a60caf587861aed611734

    • SHA512

      5f6ee227b873d4143bb693c094f4c34b23fd99f52a632df00c9d70d7a5a30d6c2764ccec0fd637da923071a3f9010dad71ab7c5beff75e5858ef8f8e2084d2c9

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks