Overview

overview

10

Static

static

8

emotet_e2_...oc.doc

windows7_x64

10

emotet_e2_...oc.doc

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    emotet_e2_d22d7440cc55189d7d805520a53cedb9041f18b97d3a1bfb652a611fc4fb0ca9_2021-01-13__023100109024._doc

  • Size

    157KB

  • Sample

    210113-lpmv2y2bdj

  • MD5

    a300d77e6b8243d0e226ee2fddc867f6

  • SHA1

    4f56f328a9090f27f975007c01f3111593103db9

  • SHA256

    d22d7440cc55189d7d805520a53cedb9041f18b97d3a1bfb652a611fc4fb0ca9

  • SHA512

    79c46474add4eb9e9998e15719880855b931979cc3b0d2cfec3a36bc6e0c7b9d85aeb4f9397051ffd613511b47e1c8f9476b8bc4a3d62c6a2a76217e0027a235

Score
10/10
macro

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://altrashift.com/wp-includes/I/
exe.dropper

https://ojodetigremezcal.com/wp/i62s/
exe.dropper

https://snowremoval-services.com/wp-content/P3Z/
exe.dropper

http://kitsunecomplements.com/too-much-phppq/n65U/
exe.dropper

https://imperioone.com/content/WOBq/
exe.dropper

http://www.autoeck-baden.at/wp-content/w0Vb/
exe.dropper

https://shop.animewho.com/content/Tj/

Targets

    • Target

      emotet_e2_d22d7440cc55189d7d805520a53cedb9041f18b97d3a1bfb652a611fc4fb0ca9_2021-01-13__023100109024._doc

    • Size

      157KB

    • MD5

      a300d77e6b8243d0e226ee2fddc867f6

    • SHA1

      4f56f328a9090f27f975007c01f3111593103db9

    • SHA256

      d22d7440cc55189d7d805520a53cedb9041f18b97d3a1bfb652a611fc4fb0ca9

    • SHA512

      79c46474add4eb9e9998e15719880855b931979cc3b0d2cfec3a36bc6e0c7b9d85aeb4f9397051ffd613511b47e1c8f9476b8bc4a3d62c6a2a76217e0027a235

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks