General

  • Target

    303c83d7c5144514e0e1ec75306981442078f9c634f3719612309701d4c29573

  • Size

    250KB

  • Sample

    200114-kqs99whdvs

  • MD5

    86d87398a0bd0979069a00acff26aa51

  • SHA1

    1a5e2e1cddd6ce94a0cba5abcc0ab64e6b4afe4b

  • SHA256

    303c83d7c5144514e0e1ec75306981442078f9c634f3719612309701d4c29573

  • SHA512

    5da641897d1583aa33bad923a580e3783df161628bd11f05f583e759c418b611c848944752011e2d5990e7b0013c997324cf73d6cf16ec54adaeaf78f653d82b

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://www.tcjsl.com/wp-admin/o8FK323881/

exe.dropper

https://tecjofer.com/wp-includes/zA1kTqXJD/

exe.dropper

https://ribatturk.com/wp-includes/54M9uFGym/

exe.dropper

https://beluxuryre.com/sandbox/2G537/

exe.dropper

https://www.allowmefirstbuildcon.com/calendar/7x/

Extracted

Family

emotet

Botnet

Epoch1

C2

70.184.69.146:80

186.177.165.196:443

139.47.135.215:80

192.241.143.52:8080

159.65.241.220:8080

45.79.95.107:443

69.163.33.84:8080

177.34.142.163:80

200.123.183.137:443

2.47.112.72:80

190.17.44.48:80

187.54.225.76:80

190.219.149.236:80

190.100.153.162:443

58.171.38.26:80

91.205.215.57:7080

152.231.89.226:80

94.176.234.118:443

201.213.100.141:8080

203.25.159.3:8080

rsa_pubkey.plain

Targets

    • Target

      303c83d7c5144514e0e1ec75306981442078f9c634f3719612309701d4c29573

    • Size

      250KB

    • MD5

      86d87398a0bd0979069a00acff26aa51

    • SHA1

      1a5e2e1cddd6ce94a0cba5abcc0ab64e6b4afe4b

    • SHA256

      303c83d7c5144514e0e1ec75306981442078f9c634f3719612309701d4c29573

    • SHA512

      5da641897d1583aa33bad923a580e3783df161628bd11f05f583e759c418b611c848944752011e2d5990e7b0013c997324cf73d6cf16ec54adaeaf78f653d82b

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails

    • Process spawned unexpected child process

    • Executes dropped EXE

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Tasks