Overview

overview

10

Static

static

8

SlurpeeDOC

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    emotet_e2_d09519bde691d7455090dd8d77cc6035dd1ddf8ce5d7b437dbd4f3bae9ba3fb9_2021-01-21__015148160026._fpx

  • Size

    165KB

  • Sample

    210121-ca7y36nc8j

  • MD5

    66b23254a90dbfe8ee080e6c86959ab3

  • SHA1

    0013f337fcacdbead3c981ad96cbfc888de5c966

  • SHA256

    d09519bde691d7455090dd8d77cc6035dd1ddf8ce5d7b437dbd4f3bae9ba3fb9

  • SHA512

    1d5715a9e3523152744962ff5c0366f75aa62cda869607db5f006fe27bb993eab6816b16062bc75fc68c75913663fddec566631562bb4c8e4d6b51bbf03fcc56

Score
10/10
macroransomwarexlm

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://covisiononeness.org/new/F9v/
exe.dropper

https://www.oshiscafe.com/wp-admin/5Dm/
exe.dropper

https://lionrockbatteries.com/wp-snapshots/C/
exe.dropper

https://www.schmuckfeder.net/reference/ubpV/
exe.dropper

http://cirteklink.com/F0xAutoConfig/1Zb4/
exe.dropper

https://nimbledesign.miami/wp-admin/C/
exe.dropper

http://xunhong.net/sys-cache/D0/

Targets

    • Target

      emotet_e2_d09519bde691d7455090dd8d77cc6035dd1ddf8ce5d7b437dbd4f3bae9ba3fb9_2021-01-21__015148160026._fpx

    • Size

      165KB

    • MD5

      66b23254a90dbfe8ee080e6c86959ab3

    • SHA1

      0013f337fcacdbead3c981ad96cbfc888de5c966

    • SHA256

      d09519bde691d7455090dd8d77cc6035dd1ddf8ce5d7b437dbd4f3bae9ba3fb9

    • SHA512

      1d5715a9e3523152744962ff5c0366f75aa62cda869607db5f006fe27bb993eab6816b16062bc75fc68c75913663fddec566631562bb4c8e4d6b51bbf03fcc56

    Score
    10/10
    ransomware

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Enumerates physical storage devices

      Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

      ransomware
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks