Overview

overview

10

Static

static

8

SlurpeeDOC

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    emotet_e2_51fae18ca6515a9154913bc82e245a72308b832eb47b5785a21beb0f0a34b07e_2021-01-21__070513243476._fpx

  • Size

    164KB

  • Sample

    210121-pwc9gd4b6j

  • MD5

    8220bf1c2460fc3e6959e2c651512ffe

  • SHA1

    2f14a5a80bfe839dbb2ff4066fa0dfed9e833dfb

  • SHA256

    51fae18ca6515a9154913bc82e245a72308b832eb47b5785a21beb0f0a34b07e

  • SHA512

    9716489b774db4c1080b6a46b832904545f11c463f29c24728356fb9c20e42ec9919006d156ada479fa40a6bff324ba4b25365aa196981f75b5f18cc0e62363b

Score
10/10
macroransomwarexlm

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://trendmoversdubai.com/cgi-bin/B73/
exe.dropper

http://dryaquelingrdo.com/wp-content/SI/
exe.dropper

http://bardiastore.com/wp-admin/A1283/
exe.dropper

http://oxycode.net/wp-admin/x/
exe.dropper

http://fabulousstylz.net/248152296/TpI/
exe.dropper

http://abdo-alyemeni.com/wp-admin/seG6/
exe.dropper

http://giteslacolombiere.com/wp-admin/FV/

Targets

    • Target

      emotet_e2_51fae18ca6515a9154913bc82e245a72308b832eb47b5785a21beb0f0a34b07e_2021-01-21__070513243476._fpx

    • Size

      164KB

    • MD5

      8220bf1c2460fc3e6959e2c651512ffe

    • SHA1

      2f14a5a80bfe839dbb2ff4066fa0dfed9e833dfb

    • SHA256

      51fae18ca6515a9154913bc82e245a72308b832eb47b5785a21beb0f0a34b07e

    • SHA512

      9716489b774db4c1080b6a46b832904545f11c463f29c24728356fb9c20e42ec9919006d156ada479fa40a6bff324ba4b25365aa196981f75b5f18cc0e62363b

    Score
    10/10
    ransomware

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Enumerates physical storage devices

      Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

      ransomware
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks