General

  • Target

    47aa23a546c5d306db66d344a768dd09512a2fcd0506383996d3504bad3e8afd

  • Size

    552KB

  • Sample

    191212-77zqkjgrnx

  • MD5

    1a5591503d596e1e0864e4bd279ddd5d

  • SHA1

    08fe72b01b4b8d1a7256b36f6b0b411fa8504bbb

  • SHA256

    47aa23a546c5d306db66d344a768dd09512a2fcd0506383996d3504bad3e8afd

  • SHA512

    287cd06c2ecab583c796b9ab847918eb570581e86323fa7d66b6de500c9771af5d81b5bc3816f8645dfe9c73546a3d0bce9ed7f1931d567d78fe26150cac0903

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

190.146.14.143:443

85.235.219.74:80

78.187.204.70:80

46.105.128.215:8080

69.30.205.162:7080

192.161.190.171:8080

163.172.97.112:8080

86.98.157.3:80

113.52.135.33:7080

175.127.140.68:80

212.129.14.27:8080

200.41.121.69:443

143.95.101.72:8080

190.161.67.63:80

50.116.78.109:8080

37.46.129.215:8080

119.57.36.54:8080

212.112.113.235:80

46.105.131.68:8080

1.32.54.12:8080

rsa_pubkey.plain

Targets

    • Target

      47aa23a546c5d306db66d344a768dd09512a2fcd0506383996d3504bad3e8afd

    • Size

      552KB

    • MD5

      1a5591503d596e1e0864e4bd279ddd5d

    • SHA1

      08fe72b01b4b8d1a7256b36f6b0b411fa8504bbb

    • SHA256

      47aa23a546c5d306db66d344a768dd09512a2fcd0506383996d3504bad3e8afd

    • SHA512

      287cd06c2ecab583c796b9ab847918eb570581e86323fa7d66b6de500c9771af5d81b5bc3816f8645dfe9c73546a3d0bce9ed7f1931d567d78fe26150cac0903

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Tasks