Overview

overview

10

Static

static

8

emotet_v6

windows10-1703-x64

10

emotet_doc

windows10-1703-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    6063dca724986586b6d1a461fae8fbde536d717c1916e449dd16686fb34fc36e.xls

  • Size

    217KB

  • Sample

    221103-y5xwtsghdl

  • MD5

    4e83eb23a98ce5b1fd48ea6be11494a0

  • SHA1

    ce0fe9bc1bd4a13133b02f52ff17edc28693d95b

  • SHA256

    6063dca724986586b6d1a461fae8fbde536d717c1916e449dd16686fb34fc36e

  • SHA512

    8c75646aedd38adf44fd618d865afe03429ecc9547d8df042f2942dca9cfcfd5462105cad6dd19d8b007b08d97589ad3db84acbd0f798787415fee0fe73c579b

  • SSDEEP

    6144:OKpb8rGYrMPe3q7Q0XV5xtuEsi8/dg8yY+TAQXTHGUMEyP5p6f5jQmd:nbGUMVWlbd

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://kabaruntukrakyat.com/wp-content/B9oJ0jh/
xlm40.dropper

http://coinkub.com/wp-content/WwrJvjumS/
xlm40.dropper

https://aberractivity.hu/iqq/Dmtv/
xlm40.dropper

https://anamafegarcia.es/css/HfFXMTXvc40t/

Targets

    • Target

      6063dca724986586b6d1a461fae8fbde536d717c1916e449dd16686fb34fc36e.xls

    • Size

      217KB

    • MD5

      4e83eb23a98ce5b1fd48ea6be11494a0

    • SHA1

      ce0fe9bc1bd4a13133b02f52ff17edc28693d95b

    • SHA256

      6063dca724986586b6d1a461fae8fbde536d717c1916e449dd16686fb34fc36e

    • SHA512

      8c75646aedd38adf44fd618d865afe03429ecc9547d8df042f2942dca9cfcfd5462105cad6dd19d8b007b08d97589ad3db84acbd0f798787415fee0fe73c579b

    • SSDEEP

      6144:OKpb8rGYrMPe3q7Q0XV5xtuEsi8/dg8yY+TAQXTHGUMEyP5p6f5jQmd:nbGUMVWlbd

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks