Overview

overview

10

Static

static

8

IO_9119540...01.doc

windows7_x64

10

IO_9119540...01.doc

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    IO_9119540846420301801.doc
  • Size 171KB
  • Sample200728-4y6lftrdlj
  • SHA256 dcab281c030ca8ebd833b95d2379df634eec571e1ae19b6aad70ae1a0eb2e07e
  • MD5 SHA1 SHA512
Score
10/10
emotetbankerdiscoverymacrotrojan

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    https://laboratbahasa.com/wp-admin/2_5jqn_7bc/
  • exe.dropper

    http://www.interibericos.com/mantenimiento/epkxx_b4_xca/
  • exe.dropper

    http://yeandle.co.uk/5t34_ipz_2/
  • exe.dropper

    http://www.wiredmoney.net/wp-includes/9abj_oppb_75xez1i3c0/
  • exe.dropper

    http://www.worldhealthtourismcongress.org/images/nuv7_e9z9x_etch/

Targets

    • Target
      IO_9119540846420301801.doc
    • Size 171KB
    • SHA256 dcab281c030ca8ebd833b95d2379df634eec571e1ae19b6aad70ae1a0eb2e07e
    • MD5 SHA1 SHA512
    Score
    10/10
    discoverytrojanbankeremotet

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Emotet Payload

      Detects Emotet payload in memory.

    • Blacklisted process makes network request

    • Executes dropped EXE

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks