Overview

overview

10

Static

static

8

emotet_v6

windows10-1703-x64

10

emotet_doc

windows10-1703-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    206f5100c65dfa8daeca762176fac17f0f7476b37cb90cc5e74201d2b13e4ab9.xls

  • Size

    217KB

  • Sample

    221103-18y96saagm

  • MD5

    78de4e92ef9455758ab1cfd421e71879

  • SHA1

    43072104cb2b0fa34b48a6e7b115fe23ca2fa536

  • SHA256

    206f5100c65dfa8daeca762176fac17f0f7476b37cb90cc5e74201d2b13e4ab9

  • SHA512

    2a65a04b1bc8796129eb95c1b0ea81211a03ef1f5024fc7728d7d04d158837ee35de3aad1ba078b808f1dc13f8b5b5083f2dbbfc8c3a3f8547cc04641a5fe705

  • SSDEEP

    6144:zKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgXyY+TAQXTHGUMEyP5p6f5jQm2:DbGUMVWlb2

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://barkstage.es/wp-content/0E7NdYl7TZuHMJq7/
xlm40.dropper

http://contactworks.nl/images_old/NuEAhfF0PCFhvv/
xlm40.dropper

http://www.iam.ch/wp-content/cache/minify/O1OAjWnfen/
xlm40.dropper

https://www.elaboro.pl/wp-admin/J0hwyIMsk9YFIi/

Targets

    • Target

      206f5100c65dfa8daeca762176fac17f0f7476b37cb90cc5e74201d2b13e4ab9.xls

    • Size

      217KB

    • MD5

      78de4e92ef9455758ab1cfd421e71879

    • SHA1

      43072104cb2b0fa34b48a6e7b115fe23ca2fa536

    • SHA256

      206f5100c65dfa8daeca762176fac17f0f7476b37cb90cc5e74201d2b13e4ab9

    • SHA512

      2a65a04b1bc8796129eb95c1b0ea81211a03ef1f5024fc7728d7d04d158837ee35de3aad1ba078b808f1dc13f8b5b5083f2dbbfc8c3a3f8547cc04641a5fe705

    • SSDEEP

      6144:zKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgXyY+TAQXTHGUMEyP5p6f5jQm2:DbGUMVWlb2

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks