3d0f797849969d919b2a23e7c8b525550fb34076e60df60ab4e380fff6c8f9f4

General

Target

emotet_e2_3d0f797849969d919b2a23e7c8b525550fb34076e60df60ab4e380fff6c8f9f4_2021-01-13__021053369355._doc
Size

158KB
Sample

210113-qps9m74nle
MD5

096d0498021f8d0f5e806ea6363245cb
SHA1

18f8ddb1130ade487defac9edd4d0daa7de73b06
SHA256

3d0f797849969d919b2a23e7c8b525550fb34076e60df60ab4e380fff6c8f9f4
SHA512

fee303923e7c1de141ca7219596137a7b8283475b27ea2db3ed66a3bac954857da0e340d8b34936276ca76cea137c1be4ea34c26780e93f1a1b0211448b218f1

Score

10^/10

macro

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://altrashift.com/wp-includes/I/

exe.dropper

https://ojodetigremezcal.com/wp/i62s/

exe.dropper

https://snowremoval-services.com/wp-content/P3Z/

exe.dropper

http://kitsunecomplements.com/too-much-phppq/n65U/

exe.dropper

https://imperioone.com/content/WOBq/

exe.dropper

http://www.autoeck-baden.at/wp-content/w0Vb/

exe.dropper

https://shop.animewho.com/content/Tj/

Targets

- Target
  
  emotet_e2_3d0f797849969d919b2a23e7c8b525550fb34076e60df60ab4e380fff6c8f9f4_2021-01-13__021053369355._doc
- Size
  
  158KB
- MD5
  
  096d0498021f8d0f5e806ea6363245cb
- SHA1
  
  18f8ddb1130ade487defac9edd4d0daa7de73b06
- SHA256
  
  3d0f797849969d919b2a23e7c8b525550fb34076e60df60ab4e380fff6c8f9f4
- SHA512
  
  fee303923e7c1de141ca7219596137a7b8283475b27ea2db3ed66a3bac954857da0e340d8b34936276ca76cea137c1be4ea34c26780e93f1a1b0211448b218f1
Score

10^/10
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Process spawned unexpected child process

Blocklisted process makes network request

Loads dropped DLL

Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2