Overview

overview

10

Static

static

8

SCAN9265_0005.xls

windows7_x64

10

SCAN9265_0005.xls

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SCAN9265_0005.xls
  • Size 40KB
  • Sample220512-pc6htsdhe2
  • SHA256 23f794cc8a7022ea9c31ea6dbb8a6235d805b60b52a837d538dc1be46c1ce468
  • MD5 SHA1 SHA512
Score
10/10
emotetbankermacrosuricatatrojanxlm

Malware Config

Extracted

Language

  • xlm4.0

Source
URLs
  • xlm40.dropper

    https://www.itesmeitic.com/term/IFjx5ElE0ldr8wDDHjub/
  • xlm40.dropper

    https://www.ingonherbal.com/application/PhEbceg4Tx/
  • xlm40.dropper

    http://ftp.colibriconstruction.net/cc/KHieqeOsagkmlGIuXc56/
  • xlm40.dropper

    http://commune-ariana.tn/sites/3BvaCmo/

Extracted

Language

  • xlm4.0

Source
URLs
  • xlm40.dropper

    https://www.itesmeitic.com/term/IFjx5ElE0ldr8wDDHjub/

Targets

    • Target
      SCAN9265_0005.xls
    • Size 40KB
    • SHA256 23f794cc8a7022ea9c31ea6dbb8a6235d805b60b52a837d538dc1be46c1ce468
    • MD5 SHA1 SHA512
    Score
    10/10
    emotetbankersuricatatrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • suricata: ET MALWARE W32/Emotet CnC Beacon 3

      suricata: ET MALWARE W32/Emotet CnC Beacon 3

      suricata

    • Downloads MZ/PE file

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks