Overview

overview

10

Static

static

8

emotet_v6

windows10-1703-x64

10

emotet_doc

windows10-1703-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    09a000f29cf4a07064de4eb582897537ad796ff4c8afca61174cd86066442889.xls

  • Size

    217KB

  • Sample

    221104-c762maadb8

  • MD5

    64aea46e6ef6ff7d5b4ddde87bed8f6f

  • SHA1

    67586125dce100a18d71430f0d4994c162b2ae41

  • SHA256

    09a000f29cf4a07064de4eb582897537ad796ff4c8afca61174cd86066442889

  • SHA512

    d2daadbc4923e411cdee718e5d52044a6ae788f31d3b16368a0de3098b3d1c45aada9448f3acee5d23566ec9844200e3443293709234b9915409c66ece02e9c5

  • SSDEEP

    6144:zKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgXyY+TAQXTHGUMEyP5p6f5jQm2:DbGUMVWlb2

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://barkstage.es/wp-content/0E7NdYl7TZuHMJq7/
xlm40.dropper

http://contactworks.nl/images_old/NuEAhfF0PCFhvv/
xlm40.dropper

http://www.iam.ch/wp-content/cache/minify/O1OAjWnfen/
xlm40.dropper

https://www.elaboro.pl/wp-admin/J0hwyIMsk9YFIi/

Targets

    • Target

      09a000f29cf4a07064de4eb582897537ad796ff4c8afca61174cd86066442889.xls

    • Size

      217KB

    • MD5

      64aea46e6ef6ff7d5b4ddde87bed8f6f

    • SHA1

      67586125dce100a18d71430f0d4994c162b2ae41

    • SHA256

      09a000f29cf4a07064de4eb582897537ad796ff4c8afca61174cd86066442889

    • SHA512

      d2daadbc4923e411cdee718e5d52044a6ae788f31d3b16368a0de3098b3d1c45aada9448f3acee5d23566ec9844200e3443293709234b9915409c66ece02e9c5

    • SSDEEP

      6144:zKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgXyY+TAQXTHGUMEyP5p6f5jQm2:DbGUMVWlb2

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks