General

  • Target

    2d81565b3a488568df69e8fcacd9ca24b4afb50ce479521fbf15e31e65e1311c.doc

  • Size

    124KB

  • Sample

    200130-r3exzkps8j

  • MD5

    0384db65d0a2a0343910bd493c787f30

  • SHA1

    57f9c02554360063e87fd7456e44df9176a1bbe9

  • SHA256

    2d81565b3a488568df69e8fcacd9ca24b4afb50ce479521fbf15e31e65e1311c

  • SHA512

    b855a06f1ab4529fe6d590154aac908db9b68903fabba607b5a9e9224aac2d12b855124b76b896dda04a8da823f6bda5bbf18cf7b381693d1353fb155648c9d1

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://www.tejasviprabhulkar.com/wp-content/bVK29415/

exe.dropper

http://skylines-tec.com/wp-includes/sYYek57/

exe.dropper

https://kz.f-chain.com/wp-content/zDYaqX/

exe.dropper

http://sittay.com/wp1/trXrrE/

exe.dropper

http://www.yitongyilian.com/calendar/LtMHbKKL/

Extracted

Family

emotet

Botnet

Epoch1

C2

70.184.112.55:80

5.34.158.102:80

144.139.91.187:80

104.236.161.64:8080

89.19.20.202:443

12.162.84.2:8080

74.50.51.115:7080

172.104.169.32:8080

177.188.121.26:443

89.32.150.160:8080

177.103.159.44:80

87.106.46.107:8080

188.135.15.49:80

31.16.195.72:80

119.59.124.163:8080

113.190.254.245:80

77.55.211.77:8080

187.54.225.76:80

200.45.187.90:80

5.196.35.138:7080

rsa_pubkey.plain

Targets

    • Target

      2d81565b3a488568df69e8fcacd9ca24b4afb50ce479521fbf15e31e65e1311c.doc

    • Size

      124KB

    • MD5

      0384db65d0a2a0343910bd493c787f30

    • SHA1

      57f9c02554360063e87fd7456e44df9176a1bbe9

    • SHA256

      2d81565b3a488568df69e8fcacd9ca24b4afb50ce479521fbf15e31e65e1311c

    • SHA512

      b855a06f1ab4529fe6d590154aac908db9b68903fabba607b5a9e9224aac2d12b855124b76b896dda04a8da823f6bda5bbf18cf7b381693d1353fb155648c9d1

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails

    • Process spawned unexpected child process

    • Executes dropped EXE

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks