General

  • Target
    c0dd587fad3622d86caca6104862bf31d7b773b67023e6dcf46e198e6e1313cd
  • Size 250KB
  • Sample200114-hncl4rfffe
  • SHA256 c0dd587fad3622d86caca6104862bf31d7b773b67023e6dcf46e198e6e1313cd
  • MD5 SHA1 SHA512

Malware Config

Extracted

Language
  • ps1

Source
URLs
  • exe.dropper

    http://farsmix.com/wp-admin/xpk881/

  • exe.dropper

    http://thuong.bidiworks.com/wp-content/q2TO1988/

  • exe.dropper

    https://securiteordi.com/wofk253jeksed/QO485/

  • exe.dropper

    http://ziyinshedege.com/wp-content/TIGc/

  • exe.dropper

    http://luilao.com/yakattack/EmXdYs3Rf/

Extracted

Family
  • emotet

Botnet
  • Epoch1

C2
  • 70.184.69.146:80

  • 186.177.165.196:443

  • 139.47.135.215:80

  • 192.241.143.52:8080

  • 159.65.241.220:8080

  • 45.79.95.107:443

  • 69.163.33.84:8080

  • 177.34.142.163:80

  • 200.123.183.137:443

  • 2.47.112.72:80

  • 190.17.44.48:80

  • 187.54.225.76:80

  • 190.219.149.236:80

  • 190.100.153.162:443

  • 58.171.38.26:80

  • 91.205.215.57:7080

  • 152.231.89.226:80

  • 94.176.234.118:443

  • 201.213.100.141:8080

  • 203.25.159.3:8080

rsa_pubkey.plain

Targets

    • Target
      c0dd587fad3622d86caca6104862bf31d7b773b67023e6dcf46e198e6e1313cd
    • Size 250KB
    • SHA256 c0dd587fad3622d86caca6104862bf31d7b773b67023e6dcf46e198e6e1313cd
    • MD5 SHA1 SHA512
    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails

    • Process spawned unexpected child process

    • Executes dropped EXE

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks