Overview

overview

10

Static

static

8

emotet_v6

windows10_x64

10

emotet_doc

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4ad49903ce2436cf77cb3fb133762d3a3d38e8161b3a4c0a0aee2f789f2602f9

  • Size

    83KB

  • Sample

    220112-cjgrtsafb3

  • MD5

    05a4c6dc200a00cb21036d82d13f0417

  • SHA1

    e9448848828a936fa22acdd61f4edf4ee0bcb9f2

  • SHA256

    4ad49903ce2436cf77cb3fb133762d3a3d38e8161b3a4c0a0aee2f789f2602f9

  • SHA512

    e377feed73675b0f6e255249eea1adb456cf4a9ebe96383cd2fab901b615fc20e084fc50e86f55733c1a1d98cc8f44dd5e17f5b2879520938fd047ec7ad85257

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://unifiedpharma.com/wp-admin/ildi5K2aTIrdvEobQ/
xlm40.dropper

https://kauffmancreates.com/images/G8050LVq/
xlm40.dropper

https://sanagrafix.com/udll/fki4w1vFApT4Rwjp1R/

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://unifiedpharma.com/wp-admin/ildi5K2aTIrdvEobQ/

Targets

    • Target

      4ad49903ce2436cf77cb3fb133762d3a3d38e8161b3a4c0a0aee2f789f2602f9

    • Size

      83KB

    • MD5

      05a4c6dc200a00cb21036d82d13f0417

    • SHA1

      e9448848828a936fa22acdd61f4edf4ee0bcb9f2

    • SHA256

      4ad49903ce2436cf77cb3fb133762d3a3d38e8161b3a4c0a0aee2f789f2602f9

    • SHA512

      e377feed73675b0f6e255249eea1adb456cf4a9ebe96383cd2fab901b615fc20e084fc50e86f55733c1a1d98cc8f44dd5e17f5b2879520938fd047ec7ad85257

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks