General

  • Target

    e834f6146588d6b07448da79aefa1f7340824c785f3585b397b78358a7e0a4a6

  • Size

    243KB

  • Sample

    200116-2dshf6qxpe

  • MD5

    9602a232c101c4c3ce21b1f4dfa78b10

  • SHA1

    8587265d198f825705a1984571e5ec6006ad6424

  • SHA256

    e834f6146588d6b07448da79aefa1f7340824c785f3585b397b78358a7e0a4a6

  • SHA512

    aed90c8a449e78bfec1a1b954ab479d34f1586702abe71d5c544386de07c39603ab94546dd4ece0f7c1c3a527ae02a8c682890763667d75a4abf3e93d6fe0842

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://media.najaminstitute.com/zlnl4e/bygv89z/

exe.dropper

http://ektisadona.com/wp-includes/vq7/

exe.dropper

http://iiatlanta.com/wp-admin/joABbF/

exe.dropper

http://wotan.info/wp-content/jz5p/

exe.dropper

http://grayandwhite.com/wp-admin/9/

Extracted

Family

emotet

Botnet

Epoch2

C2

24.196.49.98:80

93.147.141.5:443

72.189.57.105:80

91.250.96.22:8080

37.187.72.193:8080

104.131.44.150:8080

167.71.10.37:8080

27.109.153.201:8090

105.247.123.133:8080

190.12.119.180:443

120.151.135.224:80

221.165.123.72:80

103.86.49.11:8080

178.237.139.83:8080

5.32.55.214:80

95.213.236.64:8080

189.203.177.41:443

78.24.219.147:8080

190.117.226.104:80

73.11.153.178:8080

rsa_pubkey.plain

Targets

    • Target

      e834f6146588d6b07448da79aefa1f7340824c785f3585b397b78358a7e0a4a6

    • Size

      243KB

    • MD5

      9602a232c101c4c3ce21b1f4dfa78b10

    • SHA1

      8587265d198f825705a1984571e5ec6006ad6424

    • SHA256

      e834f6146588d6b07448da79aefa1f7340824c785f3585b397b78358a7e0a4a6

    • SHA512

      aed90c8a449e78bfec1a1b954ab479d34f1586702abe71d5c544386de07c39603ab94546dd4ece0f7c1c3a527ae02a8c682890763667d75a4abf3e93d6fe0842

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails

    • Process spawned unexpected child process

    • Executes dropped EXE

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks