Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    a484f81bb19306144e2063631b3fb740c6b2b192e088aadaa2647e5f6bf7d31f

  • Size

    205KB

  • Sample

    191219-z51g9y364x

  • MD5

    7e7cc2e07e40f97ff7c85bc170cb6f6e

  • SHA1

    19fe5b9f920f6cde8b0da17c9ed7a5caf834cf13

  • SHA256

    a484f81bb19306144e2063631b3fb740c6b2b192e088aadaa2647e5f6bf7d31f

  • SHA512

    fe14909ac37ea7ba8b2bb13d0159601e544091e09b20db5959990a13263827dcff2019ffd2b1095706be97e3db15cd73f531029f469e685aeb0411792fb311ed

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://www.textilesunrise.com/anjuv/lymjn-kpc564-0052/

exe.dropper

https://pakspaservices.com/cgi-bin/ykvrg-yt75yx1-43/

exe.dropper

https://www.helenelagnieu.fr/wp-includes/lvtehd-cg9sdb-59/

exe.dropper

http://ondesignstudio.in/sitemap/a5r48v5-6mpz-0938187/

exe.dropper

https://www.lubinco.co.il/wp-content/LMnGPljQ/

Extracted

Family

emotet

Botnet

Epoch3

C2

66.229.161.86:443

190.47.236.83:80

217.12.70.226:80

164.68.115.146:8080

5.189.148.98:8080

46.105.128.215:8080

69.30.205.162:7080

95.216.207.86:7080

128.92.54.20:80

185.192.75.240:443

41.77.74.214:443

190.38.252.45:443

124.150.175.129:8080

191.100.24.201:50000

178.134.1.238:80

72.51.153.27:80

210.224.65.117:80

83.156.88.159:80

190.171.135.235:80

100.38.11.243:80

rsa_pubkey.plain

Targets

    • Target

      a484f81bb19306144e2063631b3fb740c6b2b192e088aadaa2647e5f6bf7d31f

    • Size

      205KB

    • MD5

      7e7cc2e07e40f97ff7c85bc170cb6f6e

    • SHA1

      19fe5b9f920f6cde8b0da17c9ed7a5caf834cf13

    • SHA256

      a484f81bb19306144e2063631b3fb740c6b2b192e088aadaa2647e5f6bf7d31f

    • SHA512

      fe14909ac37ea7ba8b2bb13d0159601e544091e09b20db5959990a13263827dcff2019ffd2b1095706be97e3db15cd73f531029f469e685aeb0411792fb311ed

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails

    • Process spawned unexpected child process

    • Executes dropped EXE

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks