Overview

overview

10

Static

static

8

emotet_v6

windows10_x64

10

emotet_doc

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    689555499fd2dff9a85acca987cf63ecb004150fb9428e7336b11a90eed8a4a6

  • Size

    83KB

  • Sample

    220114-tn47cshbc3

  • MD5

    a19739c3b8b42e530b0c39885a7eb572

  • SHA1

    034d7b56335bc65f1010c24801f40f739f981418

  • SHA256

    689555499fd2dff9a85acca987cf63ecb004150fb9428e7336b11a90eed8a4a6

  • SHA512

    30cda33c13a7c5cbee38fc74846b6263ca20efc53434577855032e59f1e4376675d9f46b804e61964713d91fe7af8f9bcd3ffe010ebeec4461e45c38ea6c7238

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://therecyclingmachine.com/wp-admin/LzpOZSlkq90fYT1/
xlm40.dropper

http://zhongmaifangwu.com/TEST777/3U4Un0u/
xlm40.dropper

http://chicagocloudgroup.com/wp-content/updraft/OKXV/

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://therecyclingmachine.com/wp-admin/LzpOZSlkq90fYT1/
xlm40.dropper

http://zhongmaifangwu.com/TEST777/3U4Un0u/

Targets

    • Target

      689555499fd2dff9a85acca987cf63ecb004150fb9428e7336b11a90eed8a4a6

    • Size

      83KB

    • MD5

      a19739c3b8b42e530b0c39885a7eb572

    • SHA1

      034d7b56335bc65f1010c24801f40f739f981418

    • SHA256

      689555499fd2dff9a85acca987cf63ecb004150fb9428e7336b11a90eed8a4a6

    • SHA512

      30cda33c13a7c5cbee38fc74846b6263ca20efc53434577855032e59f1e4376675d9f46b804e61964713d91fe7af8f9bcd3ffe010ebeec4461e45c38ea6c7238

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks