Overview

overview

10

Static

static

8

emotet_v6

windows10_x64

10

emotet_doc

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5e9b0c9265b7d3fc1ff598bf2c6da327b90d200944fc0462f1079231b5403185

  • Size

    83KB

  • Sample

    220113-dls4bafeam

  • MD5

    768a5a75fdb699b7d42714d8fb938354

  • SHA1

    88c2fad607882ebbac3bc9b885c3ad043c43282a

  • SHA256

    5e9b0c9265b7d3fc1ff598bf2c6da327b90d200944fc0462f1079231b5403185

  • SHA512

    67be206ec923b8ae81720cc43c76cbf0c2da4b3251cb537d827bbf7bb16258db862ad4b0c173f3ac44fdea2a759c477c157f60dce2466eba126d0436751656a3

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://digitalcardsbychivami.xyz/includes/KrPj/
xlm40.dropper

http://demo.avionxpress.com/assets/XqQrGSKq8TrVj/
xlm40.dropper

http://swipermachinereview.xyz/wp-includes/t3Ow4KF0p0Q8oo/

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://digitalcardsbychivami.xyz/includes/KrPj/
xlm40.dropper

http://demo.avionxpress.com/assets/XqQrGSKq8TrVj/

Targets

    • Target

      5e9b0c9265b7d3fc1ff598bf2c6da327b90d200944fc0462f1079231b5403185

    • Size

      83KB

    • MD5

      768a5a75fdb699b7d42714d8fb938354

    • SHA1

      88c2fad607882ebbac3bc9b885c3ad043c43282a

    • SHA256

      5e9b0c9265b7d3fc1ff598bf2c6da327b90d200944fc0462f1079231b5403185

    • SHA512

      67be206ec923b8ae81720cc43c76cbf0c2da4b3251cb537d827bbf7bb16258db862ad4b0c173f3ac44fdea2a759c477c157f60dce2466eba126d0436751656a3

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks