General

  • Target

    8846893c9d7c2a8b9d97068084f8c171e9110cf34322e70110da781dad24cc75

  • Size

    200KB

  • Sample

    191218-2q4bex5dys

  • MD5

    e62f2edfeff116d22cc4f93d5b0313df

  • SHA1

    4df8c1cbdce38925cc640f8d9649ee9b6a210cd3

  • SHA256

    8846893c9d7c2a8b9d97068084f8c171e9110cf34322e70110da781dad24cc75

  • SHA512

    b4cccee2550788949d3d6b510f84eaa1044f3c851136bc77e9f89127cd833c4eb0c5574524589db2a81fc753aa9d19f834604c11411445dac5c414f11a89d7c8

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://moisesdavid.com/qoong/vy/

exe.dropper

http://insurancebabu.com/wp-admin/iXElcu9f/

exe.dropper

http://rishi99.com/framework.impossible/dhADGeie6/

exe.dropper

https://www.alertpage.net/confirmation/2nX/

exe.dropper

https://anttarc.org/chartaxd/DMBuiwf5u/

Extracted

Family

emotet

Botnet

Epoch2

C2

1.215.28.101:8080

184.167.148.162:80

66.25.34.20:80

165.227.156.155:443

167.99.105.223:7080

67.225.179.64:8080

176.31.200.130:8080

190.220.19.82:443

91.242.138.5:443

159.65.25.128:8080

61.197.110.214:80

110.143.84.202:80

95.128.43.213:8080

91.73.197.90:80

201.184.105.242:443

108.179.206.219:8080

181.57.193.14:80

188.152.7.140:80

139.130.241.252:443

197.254.221.174:80

rsa_pubkey.plain

Targets

    • Target

      8846893c9d7c2a8b9d97068084f8c171e9110cf34322e70110da781dad24cc75

    • Size

      200KB

    • MD5

      e62f2edfeff116d22cc4f93d5b0313df

    • SHA1

      4df8c1cbdce38925cc640f8d9649ee9b6a210cd3

    • SHA256

      8846893c9d7c2a8b9d97068084f8c171e9110cf34322e70110da781dad24cc75

    • SHA512

      b4cccee2550788949d3d6b510f84eaa1044f3c851136bc77e9f89127cd833c4eb0c5574524589db2a81fc753aa9d19f834604c11411445dac5c414f11a89d7c8

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails

    • Process spawned unexpected child process

    • Executes dropped EXE

MITRE ATT&CK Enterprise v6

Tasks