Overview

overview

10

Static

static

8

emotet_v6

windows10-1703-x64

10

emotet_doc

windows10-1703-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    931dfa85b1d35c0fcb1ec21609a08f96bdbdd35eafd6b6ba0b364ed990f043a6.xls

  • Size

    217KB

  • Sample

    221104-ppdzcahbej

  • MD5

    162609f44e112d0a9edd49ffacc23541

  • SHA1

    1fae5b52067c2a26268cd160d70d81d8da21dc55

  • SHA256

    931dfa85b1d35c0fcb1ec21609a08f96bdbdd35eafd6b6ba0b364ed990f043a6

  • SHA512

    6710bdbc54c70605b3c349dd960e83bdba0abb3c1c82897f271fee35cfd9ba67f7293159f1997b8bcfe830ee998f407fa3563f730d3e64fcfa4e4bd1628206f5

  • SSDEEP

    6144:OKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgIyY+TAQXTHGUMEyP5p6f5jQmG:bbGUMVWlbG

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://cursosinterativos.com.br/semprichickoff2/pEl/
xlm40.dropper

http://mulmatdol.com/adm/Fa/
xlm40.dropper

http://www.tugarden.com/docs/csv_import/rf6bMPAtbBPiDK/
xlm40.dropper

http://www.darularqompatean.com/asq/IcVMFfwR65Yf8fMd5G/

Targets

    • Target

      931dfa85b1d35c0fcb1ec21609a08f96bdbdd35eafd6b6ba0b364ed990f043a6.xls

    • Size

      217KB

    • MD5

      162609f44e112d0a9edd49ffacc23541

    • SHA1

      1fae5b52067c2a26268cd160d70d81d8da21dc55

    • SHA256

      931dfa85b1d35c0fcb1ec21609a08f96bdbdd35eafd6b6ba0b364ed990f043a6

    • SHA512

      6710bdbc54c70605b3c349dd960e83bdba0abb3c1c82897f271fee35cfd9ba67f7293159f1997b8bcfe830ee998f407fa3563f730d3e64fcfa4e4bd1628206f5

    • SSDEEP

      6144:OKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgIyY+TAQXTHGUMEyP5p6f5jQmG:bbGUMVWlbG

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks