General

  • Target

    229273bdb8ff5402bdd3a86d66b87a8e69588e82405f7db4426920d2f5d3168b.doc

  • Size

    174KB

  • Sample

    200128-dbk8dnkf36

  • MD5

    26b3cc362c1c355be778679ac101de4d

  • SHA1

    0dbfeceaf2294466bde223e0851b8a1b6afefaf1

  • SHA256

    229273bdb8ff5402bdd3a86d66b87a8e69588e82405f7db4426920d2f5d3168b

  • SHA512

    a558ebf7181ff475d2099020c600ff8265421611505aa02c6c42459a36915bdf622d9fff9171290d6c9c8ffa8fa6d4e2297bef08a04159b521c584678c8487d5

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://johnfrancisellis.com/87/GK5W1gS3/

exe.dropper

http://kabookapp.com/crm.kabookapp.com/afMG/

exe.dropper

http://lamilla.net/wp-content/F9GxhZ/

exe.dropper

http://lamdep24h.life/web_map/PspHv134/

exe.dropper

http://bjenkins.webview.consulting/QpbbmvTkyy/xc75659/

Extracted

Family

emotet

Botnet

Epoch1

C2

190.6.193.152:8080

200.69.224.73:80

146.255.96.214:443

74.50.51.115:7080

184.172.27.82:8080

68.183.170.114:8080

45.79.95.107:443

190.210.184.138:995

200.58.83.179:80

113.190.254.245:80

181.29.101.13:8080

185.86.148.222:8080

186.200.205.170:80

139.47.135.215:80

62.75.160.178:8080

190.219.149.236:80

190.210.236.139:80

190.100.153.162:443

91.74.175.46:80

175.139.209.3:8080

rsa_pubkey.plain

Targets

    • Target

      229273bdb8ff5402bdd3a86d66b87a8e69588e82405f7db4426920d2f5d3168b.doc

    • Size

      174KB

    • MD5

      26b3cc362c1c355be778679ac101de4d

    • SHA1

      0dbfeceaf2294466bde223e0851b8a1b6afefaf1

    • SHA256

      229273bdb8ff5402bdd3a86d66b87a8e69588e82405f7db4426920d2f5d3168b

    • SHA512

      a558ebf7181ff475d2099020c600ff8265421611505aa02c6c42459a36915bdf622d9fff9171290d6c9c8ffa8fa6d4e2297bef08a04159b521c584678c8487d5

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails

    • Process spawned unexpected child process

    • Executes dropped EXE

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Tasks