General
-
Target
emotet_e2_b80739d7b435e5a620e5c121269e1f8a2050a87d1a4d6b934107346c62d09ddc_2021-01-13__003546165353._doc
-
Size
157KB
-
Sample
210113-yhf6zwzwjj
-
MD5
10eb8fa1a6ba17505b6a14cc63aaa13f
-
SHA1
1207a59c562a2692db0d8d723d6660c468c5cadd
-
SHA256
b80739d7b435e5a620e5c121269e1f8a2050a87d1a4d6b934107346c62d09ddc
-
SHA512
07eaa1a76c58cc521661dd18fb518c88df8bab0d00b9b2807b2a4604df3951ed31b1de828aa09c726146e4c8aba4f5709b86190bffa49bc8c10097ab1720cf2f
Static task
static1
Behavioral task
behavioral1
Sample
emotet_e2_b80739d7b435e5a620e5c121269e1f8a2050a87d1a4d6b934107346c62d09ddc_2021-01-13__003546165353._doc.doc
Resource
win7v20201028
Behavioral task
behavioral2
Sample
emotet_e2_b80739d7b435e5a620e5c121269e1f8a2050a87d1a4d6b934107346c62d09ddc_2021-01-13__003546165353._doc.doc
Resource
win10v20201028
Malware Config
Extracted
https://altrashift.com/wp-includes/I/
https://ojodetigremezcal.com/wp/i62s/
https://snowremoval-services.com/wp-content/P3Z/
http://kitsunecomplements.com/too-much-phppq/n65U/
https://imperioone.com/content/WOBq/
http://www.autoeck-baden.at/wp-content/w0Vb/
https://shop.animewho.com/content/Tj/
Targets
-
-
Target
emotet_e2_b80739d7b435e5a620e5c121269e1f8a2050a87d1a4d6b934107346c62d09ddc_2021-01-13__003546165353._doc
-
Size
157KB
-
MD5
10eb8fa1a6ba17505b6a14cc63aaa13f
-
SHA1
1207a59c562a2692db0d8d723d6660c468c5cadd
-
SHA256
b80739d7b435e5a620e5c121269e1f8a2050a87d1a4d6b934107346c62d09ddc
-
SHA512
07eaa1a76c58cc521661dd18fb518c88df8bab0d00b9b2807b2a4604df3951ed31b1de828aa09c726146e4c8aba4f5709b86190bffa49bc8c10097ab1720cf2f
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Loads dropped DLL
-
Drops file in System32 directory
-