General

  • Target

    98d62c10ed925db5df3b5320a0dbbf376ecb75878a0812ece3825b3a133434e6

  • Size

    249KB

  • Sample

    200114-n8mb8de46s

  • MD5

    fd5129282d3a43edd446ccfe20cc31d3

  • SHA1

    bb7ed8d41d4b6b328e157de0dd55c85f0ee82e8e

  • SHA256

    98d62c10ed925db5df3b5320a0dbbf376ecb75878a0812ece3825b3a133434e6

  • SHA512

    113f187bd6631336ccb0ef20cc9a9b4cf2bf7eaf020bcb77ab92138dc4017e491125ca0db3e2df9b9a62a175cde3c05b7e28c5c2ef9773c6a2d1fab5eb2a1c8e

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://farsmix.com/wp-admin/xpk881/

exe.dropper

http://thuong.bidiworks.com/wp-content/q2TO1988/

exe.dropper

https://securiteordi.com/wofk253jeksed/QO485/

exe.dropper

http://ziyinshedege.com/wp-content/TIGc/

exe.dropper

http://luilao.com/yakattack/EmXdYs3Rf/

Extracted

Family

emotet

Botnet

Epoch1

C2

70.184.69.146:80

186.177.165.196:443

139.47.135.215:80

192.241.143.52:8080

159.65.241.220:8080

45.79.95.107:443

69.163.33.84:8080

177.34.142.163:80

200.123.183.137:443

2.47.112.72:80

190.17.44.48:80

187.54.225.76:80

190.219.149.236:80

190.100.153.162:443

58.171.38.26:80

91.205.215.57:7080

152.231.89.226:80

94.176.234.118:443

201.213.100.141:8080

203.25.159.3:8080

rsa_pubkey.plain

Targets

    • Target

      98d62c10ed925db5df3b5320a0dbbf376ecb75878a0812ece3825b3a133434e6

    • Size

      249KB

    • MD5

      fd5129282d3a43edd446ccfe20cc31d3

    • SHA1

      bb7ed8d41d4b6b328e157de0dd55c85f0ee82e8e

    • SHA256

      98d62c10ed925db5df3b5320a0dbbf376ecb75878a0812ece3825b3a133434e6

    • SHA512

      113f187bd6631336ccb0ef20cc9a9b4cf2bf7eaf020bcb77ab92138dc4017e491125ca0db3e2df9b9a62a175cde3c05b7e28c5c2ef9773c6a2d1fab5eb2a1c8e

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails

    • Process spawned unexpected child process

    • Executes dropped EXE

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Tasks