Overview

overview

10

Static

static

8

emotet_v6

windows10_x64

10

emotet_doc

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    73f5720060fdda952a06d091e8fcfdb5ce66b633769feed355fc3727c83c334e

  • Size

    83KB

  • Sample

    220112-mavx7sccem

  • MD5

    eeae049e9fe4b564705af1b2aa21ad16

  • SHA1

    c4b29c68a2acb09665bef5c4e30a823f79cc0117

  • SHA256

    73f5720060fdda952a06d091e8fcfdb5ce66b633769feed355fc3727c83c334e

  • SHA512

    f2401ce7305f0a5e5d39bd0408877dad13ee6087177d235cf8710032a6ecc28d8d25510f738da5258f8fc9e2f6739ec67109595b1c3d45b968c8edde744059e6

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://unifiedpharma.com/wp-admin/ildi5K2aTIrdvEobQ/
xlm40.dropper

https://kauffmancreates.com/images/G8050LVq/
xlm40.dropper

https://sanagrafix.com/udll/fki4w1vFApT4Rwjp1R/

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://unifiedpharma.com/wp-admin/ildi5K2aTIrdvEobQ/

Targets

    • Target

      73f5720060fdda952a06d091e8fcfdb5ce66b633769feed355fc3727c83c334e

    • Size

      83KB

    • MD5

      eeae049e9fe4b564705af1b2aa21ad16

    • SHA1

      c4b29c68a2acb09665bef5c4e30a823f79cc0117

    • SHA256

      73f5720060fdda952a06d091e8fcfdb5ce66b633769feed355fc3727c83c334e

    • SHA512

      f2401ce7305f0a5e5d39bd0408877dad13ee6087177d235cf8710032a6ecc28d8d25510f738da5258f8fc9e2f6739ec67109595b1c3d45b968c8edde744059e6

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks