Overview

overview

10

Static

static

8

emotet_v6

windows10_x64

10

emotet_doc

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d8fd315efba4dd6e72aaf30eb91ac6bbdc046717708c740158751ebf6a9e18d4

  • Size

    83KB

  • Sample

    220114-gqxh3sefc6

  • MD5

    1a834541b79e517d6901e2eb1c4941f0

  • SHA1

    c301d1ee62a68af5af760c231900fc993dacabd8

  • SHA256

    d8fd315efba4dd6e72aaf30eb91ac6bbdc046717708c740158751ebf6a9e18d4

  • SHA512

    2e6996cc20f4de48d7d401ce451320b084959f5b040e62a4812777a20683839c990e452bf7ff0aacdff554684bd645c2a0487c5e7c9702050fa54e2fc5ce1409

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://shopnhap.com/highbinder/UedVfTHDf5Em40/
xlm40.dropper

https://celhocortofilmfestival.stream/css/Naq/
xlm40.dropper

https://astrologersandeepbhargav.com/wp-admin/FRwR9VH/

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://shopnhap.com/highbinder/UedVfTHDf5Em40/

Targets

    • Target

      d8fd315efba4dd6e72aaf30eb91ac6bbdc046717708c740158751ebf6a9e18d4

    • Size

      83KB

    • MD5

      1a834541b79e517d6901e2eb1c4941f0

    • SHA1

      c301d1ee62a68af5af760c231900fc993dacabd8

    • SHA256

      d8fd315efba4dd6e72aaf30eb91ac6bbdc046717708c740158751ebf6a9e18d4

    • SHA512

      2e6996cc20f4de48d7d401ce451320b084959f5b040e62a4812777a20683839c990e452bf7ff0aacdff554684bd645c2a0487c5e7c9702050fa54e2fc5ce1409

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks