Overview

overview

10

Static

static

8

emotet_v6

windows10_x64

10

emotet_doc

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    60610dee4927e907b5a6a4ac49f8c921fa8af7005b2e8deb2b26ffcc1cac6322

  • Size

    83KB

  • Sample

    220112-24fgyaeeb8

  • MD5

    044c399cb95459d89ce15247a7f4fb0b

  • SHA1

    0621fb8e28e870a5b13229a2a18758ce306c9896

  • SHA256

    60610dee4927e907b5a6a4ac49f8c921fa8af7005b2e8deb2b26ffcc1cac6322

  • SHA512

    9362ecf9910eceb607f82d3af4e176b4dc51c9164904456ca4083a8a7140ac3c585bc021938bc12bfbce8d648992e3c0693d53a09bdda9d37536c65b4ec34233

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://yuanbinglun.com/www.yuanbinglun.com/7kKwqmxRWQK0OLi/
xlm40.dropper

http://laserjetprintersreview.xyz/wp-includes/BJ6yUJ/
xlm40.dropper

http://2021.posadamision.com/wp-admin/IoqaL08/

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://yuanbinglun.com/www.yuanbinglun.com/7kKwqmxRWQK0OLi/

Targets

    • Target

      60610dee4927e907b5a6a4ac49f8c921fa8af7005b2e8deb2b26ffcc1cac6322

    • Size

      83KB

    • MD5

      044c399cb95459d89ce15247a7f4fb0b

    • SHA1

      0621fb8e28e870a5b13229a2a18758ce306c9896

    • SHA256

      60610dee4927e907b5a6a4ac49f8c921fa8af7005b2e8deb2b26ffcc1cac6322

    • SHA512

      9362ecf9910eceb607f82d3af4e176b4dc51c9164904456ca4083a8a7140ac3c585bc021938bc12bfbce8d648992e3c0693d53a09bdda9d37536c65b4ec34233

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks