General

  • Target

    e9e238381a9c7d5badf26a88ec716432f8b640c3935a658d2ee741116cac36e8.doc

  • Size

    176KB

  • Sample

    200128-arrlmq1qan

  • MD5

    38a6a3134cf96badea076e3eecc96c88

  • SHA1

    624dcbe7f543725678b835107526fe9b3d6bb7dc

  • SHA256

    e9e238381a9c7d5badf26a88ec716432f8b640c3935a658d2ee741116cac36e8

  • SHA512

    13dce6afb740059419b898c893eec5a38f72e04d292a4526371f032a7c5ab58d5929760e3f1cc13f7efa7c78a44597f92c5221c0407fa7b814487be9a82c9668

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://healthbrate.com/wordpress/k3/

exe.dropper

https://plussizeforall.com/22s/H6e/

exe.dropper

https://swimsuitforwomens.com/wp-admin/xfa92/

exe.dropper

https://plussizeall.net/wp-admin/nn9x71f/

exe.dropper

https://makeupandbeautyguides.com/wp-admin/sva8/

Extracted

Family

emotet

Botnet

Epoch2

C2

207.177.72.129:8080

23.243.215.4:8080

218.255.173.106:80

136.243.205.112:7080

23.92.16.164:8080

45.55.65.123:8080

217.160.19.232:8080

64.66.6.71:8080

66.34.201.20:7080

85.152.174.56:80

202.175.121.202:8090

87.106.139.101:8080

176.9.43.37:8080

98.156.206.153:80

159.65.25.128:8080

70.184.9.39:8080

209.146.22.34:443

95.213.236.64:8080

98.30.113.161:80

59.103.164.174:80

rsa_pubkey.plain

Targets

    • Target

      e9e238381a9c7d5badf26a88ec716432f8b640c3935a658d2ee741116cac36e8.doc

    • Size

      176KB

    • MD5

      38a6a3134cf96badea076e3eecc96c88

    • SHA1

      624dcbe7f543725678b835107526fe9b3d6bb7dc

    • SHA256

      e9e238381a9c7d5badf26a88ec716432f8b640c3935a658d2ee741116cac36e8

    • SHA512

      13dce6afb740059419b898c893eec5a38f72e04d292a4526371f032a7c5ab58d5929760e3f1cc13f7efa7c78a44597f92c5221c0407fa7b814487be9a82c9668

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails

    • Process spawned unexpected child process

    • Executes dropped EXE

MITRE ATT&CK Enterprise v6

Tasks