General

  • Target

    dcc00cbf714f3d7d6c6381724d26c998cade57d76c85e05ff60df93704cbacc2

  • Size

    251KB

  • Sample

    200114-f3ek1rchl2

  • MD5

    d9bfe83505e825756c54ca25095f8ee4

  • SHA1

    89a6a31a80a1a3fb55f94e746baa440f66d7ec2b

  • SHA256

    dcc00cbf714f3d7d6c6381724d26c998cade57d76c85e05ff60df93704cbacc2

  • SHA512

    0198790929fb0f143a334f48b282fa7e2e4c47c81896f9b598caf376a2927bc0621111a5e49d186c02ba1b829e598a81c73b7006009cc02454033bf6f1c4ebd4

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://staging.visionarystream.com/wp-includes/KXst/

exe.dropper

http://bhsleepcenterandspas.com/wp-includes/6Vkd7363/

exe.dropper

http://tzptyz.com/mjgy2/MdHJ7k/

exe.dropper

https://upandatom.biz/credentials/Lcf80251/

exe.dropper

http://cncgate.com/wp-content/uploads/D7/

Extracted

Family

emotet

Botnet

Epoch1

C2

70.184.69.146:80

186.177.165.196:443

139.47.135.215:80

192.241.143.52:8080

159.65.241.220:8080

45.79.95.107:443

69.163.33.84:8080

177.34.142.163:80

200.123.183.137:443

2.47.112.72:80

190.17.44.48:80

187.54.225.76:80

190.219.149.236:80

190.100.153.162:443

58.171.38.26:80

91.205.215.57:7080

152.231.89.226:80

94.176.234.118:443

201.213.100.141:8080

203.25.159.3:8080

rsa_pubkey.plain

Targets

    • Target

      dcc00cbf714f3d7d6c6381724d26c998cade57d76c85e05ff60df93704cbacc2

    • Size

      251KB

    • MD5

      d9bfe83505e825756c54ca25095f8ee4

    • SHA1

      89a6a31a80a1a3fb55f94e746baa440f66d7ec2b

    • SHA256

      dcc00cbf714f3d7d6c6381724d26c998cade57d76c85e05ff60df93704cbacc2

    • SHA512

      0198790929fb0f143a334f48b282fa7e2e4c47c81896f9b598caf376a2927bc0621111a5e49d186c02ba1b829e598a81c73b7006009cc02454033bf6f1c4ebd4

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails

    • Process spawned unexpected child process

    • Executes dropped EXE

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Tasks