Overview

overview

10

Static

static

8

emotet_v6

windows10_x64

10

emotet_doc

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    348096634dee34b5a2997542f31eba52bbff0f83680ac20e2c2c4030ec0b4baa

  • Size

    99KB

  • Sample

    220118-jsr3gsaddk

  • MD5

    d9840ff5aef4fcb1e822376f0cbd15ba

  • SHA1

    f109110de7bb4691602099bb25ad64e7807194e7

  • SHA256

    348096634dee34b5a2997542f31eba52bbff0f83680ac20e2c2c4030ec0b4baa

  • SHA512

    6666d6935aafd3f12e9f1f57774d75e72eaa72fa03630a1cf426e7445820414602daeadda607a5fe55f3b5207763cf998e182bee359edcfa8d05cf1df6e99715

Score
10/10
macrosuricataxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://shop.lambolero.com/iiwkjgp/eu7rH6/
xlm40.dropper

http://api.task-lite.com/-/EYe3DEfcw7LCaU6T/
xlm40.dropper

https://celhocortofilmfestival.stream/css/oQSBr44obE/

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://shop.lambolero.com/iiwkjgp/eu7rH6/

Targets

    • Target

      348096634dee34b5a2997542f31eba52bbff0f83680ac20e2c2c4030ec0b4baa

    • Size

      99KB

    • MD5

      d9840ff5aef4fcb1e822376f0cbd15ba

    • SHA1

      f109110de7bb4691602099bb25ad64e7807194e7

    • SHA256

      348096634dee34b5a2997542f31eba52bbff0f83680ac20e2c2c4030ec0b4baa

    • SHA512

      6666d6935aafd3f12e9f1f57774d75e72eaa72fa03630a1cf426e7445820414602daeadda607a5fe55f3b5207763cf998e182bee359edcfa8d05cf1df6e99715

    Score
    10/10
    suricata

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • suricata: ET MALWARE W32/Emotet CnC Beacon 3

      suricata: ET MALWARE W32/Emotet CnC Beacon 3

      suricata

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks