Overview

overview

10

Static

static

8

emotet_v6

windows10_x64

10

emotet_doc

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    21cd95fb4f71525407b37a901590819a18d24ca48bd6b8f7170ff423e780dd4b

  • Size

    106KB

  • Sample

    220330-wj9mdsfcb9

  • MD5

    363e410baecdaa6ca488170ce8c5c9e2

  • SHA1

    7654990566a8779110c4e67daad7ad6b0ddefc80

  • SHA256

    21cd95fb4f71525407b37a901590819a18d24ca48bd6b8f7170ff423e780dd4b

  • SHA512

    0a29e2e15db433126fa2b7cb6a2fb1051809b7a70fdf6d2409d02a065934d2f08e741eef1aa735f1ef656258061f76bca2fe53993388ab2f6128ccc92798d050

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://www.gessersh.com/wp-includes/ZwQLepW/
xlm40.dropper

http://www.garantihaliyikama.com/wp-admin/FjgB6I/
xlm40.dropper

https://www.fantasticmotion.jp/_cnskin/qfWEQrrwBg/
xlm40.dropper

http://dmcontabilidade.com/correspondentecaixa/TrS/
xlm40.dropper

https://fcelik.nl/rittenregistratie/web/css/B3ILfU8Xk2SsEmT/
xlm40.dropper

http://fanfield.co.uk/cgi-bin/7pp6DjWFNJXY8/

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://www.gessersh.com/wp-includes/ZwQLepW/

Targets

    • Target

      21cd95fb4f71525407b37a901590819a18d24ca48bd6b8f7170ff423e780dd4b

    • Size

      106KB

    • MD5

      363e410baecdaa6ca488170ce8c5c9e2

    • SHA1

      7654990566a8779110c4e67daad7ad6b0ddefc80

    • SHA256

      21cd95fb4f71525407b37a901590819a18d24ca48bd6b8f7170ff423e780dd4b

    • SHA512

      0a29e2e15db433126fa2b7cb6a2fb1051809b7a70fdf6d2409d02a065934d2f08e741eef1aa735f1ef656258061f76bca2fe53993388ab2f6128ccc92798d050

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks