Overview

overview

10

Static

static

8

emotet_v6

windows10_x64

10

emotet_doc

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4c39dc4744a0993917117b044891085adf8c6f0be913b189984e1b1ceea358f1

  • Size

    83KB

  • Sample

    220113-fm63nsfhb7

  • MD5

    b0b306b576cbe99e91112a16ce40c00e

  • SHA1

    b90ba0b773291ff6e4ec74c438463975f0ad9783

  • SHA256

    4c39dc4744a0993917117b044891085adf8c6f0be913b189984e1b1ceea358f1

  • SHA512

    f2f547ef493bf7c4d70194d4fbbbba60e6f764de15d7858f976b442399be16bbf1c8cb4afc33f460b8659da74f00945a2c19801e3de2262f4aa1ef79f2d0d9aa

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://mammy-chiro.com/case/ZTkBzbz/
xlm40.dropper

http://bluetoothheadsetreview.xyz/wp-includes/xmdHAGgfki/
xlm40.dropper

http://topline36.xyz/wp-includes/css/BB9Ajvjs89U9O/

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://mammy-chiro.com/case/ZTkBzbz/
xlm40.dropper

http://bluetoothheadsetreview.xyz/wp-includes/xmdHAGgfki/

Targets

    • Target

      4c39dc4744a0993917117b044891085adf8c6f0be913b189984e1b1ceea358f1

    • Size

      83KB

    • MD5

      b0b306b576cbe99e91112a16ce40c00e

    • SHA1

      b90ba0b773291ff6e4ec74c438463975f0ad9783

    • SHA256

      4c39dc4744a0993917117b044891085adf8c6f0be913b189984e1b1ceea358f1

    • SHA512

      f2f547ef493bf7c4d70194d4fbbbba60e6f764de15d7858f976b442399be16bbf1c8cb4afc33f460b8659da74f00945a2c19801e3de2262f4aa1ef79f2d0d9aa

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks