General

  • Target

    Docs_5fac5a99c133685dfa34c3192e27fa7b.17

  • Size

    100KB

  • Sample

    191219-qvhexwqmln

  • MD5

    5fac5a99c133685dfa34c3192e27fa7b

  • SHA1

    d27a7b508db30c5211faa8e5bd7505109a3fdf62

  • SHA256

    d394ed6a30ff8bd2c2812675561d9662c72ea9d8c987dd329046f0ecfdeb9177

  • SHA512

    33bdd48b1f76e2f7012935dbd4ffe162b294e698e803e34c1763cdba165d302c79e7bb335313ae706485dbd151f816a1fb8ad818a7c11bb8445255ad11886b66

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://laclinika.com/wp-admin/r42ar70/

exe.dropper

https://thechasermart.com/wp-admin/7u93/

exe.dropper

https://zamusicport.com/wp-content/Vmc/

exe.dropper

https://zaloshop.net/wp-admin/8j0827/

exe.dropper

https://www.leatherbyd.com/PHPMailer-master/q91l5u01353/

Extracted

Family

emotet

Botnet

Epoch1

C2

68.187.160.28:443

97.120.32.227:80

187.188.166.192:8080

144.217.117.207:8080

96.126.121.64:443

104.236.137.72:8080

85.234.143.94:8080

68.174.15.223:80

63.246.252.234:80

93.148.252.90:80

74.59.187.94:80

185.160.212.3:80

46.28.111.142:7080

183.99.239.141:80

68.129.203.162:443

144.139.56.105:80

191.183.21.190:80

81.157.234.90:8080

138.68.106.4:7080

203.130.0.69:80

rsa_pubkey.plain

Targets

    • Target

      Docs_5fac5a99c133685dfa34c3192e27fa7b.17

    • Size

      100KB

    • MD5

      5fac5a99c133685dfa34c3192e27fa7b

    • SHA1

      d27a7b508db30c5211faa8e5bd7505109a3fdf62

    • SHA256

      d394ed6a30ff8bd2c2812675561d9662c72ea9d8c987dd329046f0ecfdeb9177

    • SHA512

      33bdd48b1f76e2f7012935dbd4ffe162b294e698e803e34c1763cdba165d302c79e7bb335313ae706485dbd151f816a1fb8ad818a7c11bb8445255ad11886b66

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails

    • Process spawned unexpected child process

    • Executes dropped EXE

    • Modifies system certificate store

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks