Overview

overview

10

Static

static

8

emotet_v6

windows10_x64

10

emotet_doc

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2b25518c74a4620e944ebbb70b30787175d702d7c2b9dab5072d25bda750f042

  • Size

    83KB

  • Sample

    220114-tzbn7ahbf5

  • MD5

    baf7962be614881a29bb12bb46efdc7a

  • SHA1

    63c0776962828909db62eebf5522025c598f8aa9

  • SHA256

    2b25518c74a4620e944ebbb70b30787175d702d7c2b9dab5072d25bda750f042

  • SHA512

    2fb080300a6ec49bac81b8cef11b809d1ee2d19511a7b83feaab7c576fa7e7e025899a201cd4b624625dc6e0fd9a0988fbe2a7f85cf0da12633d7b9d00c1c62f

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://therecyclingmachine.com/wp-admin/LzpOZSlkq90fYT1/
xlm40.dropper

http://zhongmaifangwu.com/TEST777/3U4Un0u/
xlm40.dropper

http://chicagocloudgroup.com/wp-content/updraft/OKXV/

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://therecyclingmachine.com/wp-admin/LzpOZSlkq90fYT1/
xlm40.dropper

http://zhongmaifangwu.com/TEST777/3U4Un0u/

Targets

    • Target

      2b25518c74a4620e944ebbb70b30787175d702d7c2b9dab5072d25bda750f042

    • Size

      83KB

    • MD5

      baf7962be614881a29bb12bb46efdc7a

    • SHA1

      63c0776962828909db62eebf5522025c598f8aa9

    • SHA256

      2b25518c74a4620e944ebbb70b30787175d702d7c2b9dab5072d25bda750f042

    • SHA512

      2fb080300a6ec49bac81b8cef11b809d1ee2d19511a7b83feaab7c576fa7e7e025899a201cd4b624625dc6e0fd9a0988fbe2a7f85cf0da12633d7b9d00c1c62f

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks