emotet

General

Target
invoice FKXF2_63920661.doc
Size 191KB
Sample200718-c8jtpmjtc2
SHA256 169f03cee2b674a04eb777235895e2e6d94f82785fac8764ebb330df2bf2448d
MD5 73c27a0a2448832998122562d4277dda
SHA1 faf702b17e89ff9598e752ec7f9e115665dedd51
SHA512 e311b3cd6c6ca6b1c8264c4eadadc0317e8f09d35a1fe40a6c934355de648ff00277c7608f659f08b2878f393c745295ca17fb54faeee9a3bdfcc5e8fc189de6
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper
http://mican.tri-comma.com/wp-admin/BmKOeycm0704/
exe.dropper
http://defensacovid.com/wp-admin/dGzIMVvo/
exe.dropper
http://doorbhai.com/wp-admin/Wq6Kdoisk1r4060453/
exe.dropper
http://agilentgame.reviewshell.com/cgi-bin/csoa45gw51315935/
exe.dropper
http://karir-up.com/wp-admin/CCzj96yk23/

Extracted

Family

emotet

Botnet

Epoch3

C2

177.144.130.105:443
198.27.69.201:8080
157.7.164.178:8081
78.188.170.128:80
203.153.216.178:7080
77.74.78.80:443
178.33.167.120:8080
177.0.241.28:80
143.95.101.72:8080
51.38.201.19:7080
181.167.35.84:80
41.185.29.128:8080
192.163.221.191:8080
181.164.110.7:80
203.153.216.182:7080
80.211.32.88:8080
113.160.180.109:80
185.142.236.163:443
192.241.220.183:8080
87.106.231.60:8080
113.161.148.81:80
181.230.65.232:80
50.116.78.109:8080
91.83.93.103:443
179.5.118.12:80
75.127.14.170:8080
46.32.229.152:8080
37.70.131.107:80
140.207.113.106:443
181.134.9.162:80
139.59.12.63:8080
46.105.131.68:8080
37.208.106.146:8080
125.63.106.22:80
110.44.113.2:8080
81.214.253.80:443
37.46.129.215:8080
14.99.112.138:80
190.251.235.239:80
190.171.153.139:80
190.55.233.156:80
46.49.124.53:80
74.208.173.91:8080
163.172.107.70:8080
192.210.217.94:8080
115.79.195.246:80
212.112.113.235:80
211.20.154.102:80
220.128.125.18:80
45.118.136.92:8080
216.75.37.196:8080
195.201.56.70:8080

rsa_pubkey.plain

Targets

- Target
  invoice FKXF2_63920661.doc
- Size 191KB
- SHA256 169f03cee2b674a04eb777235895e2e6d94f82785fac8764ebb330df2bf2448d
- MD5 73c27a0a2448832998122562d4277dda
- SHA1 faf702b17e89ff9598e752ec7f9e115665dedd51
- SHA512 e311b3cd6c6ca6b1c8264c4eadadc0317e8f09d35a1fe40a6c934355de648ff00277c7608f659f08b2878f393c745295ca17fb54faeee9a3bdfcc5e8fc189de6
- MD5 SHA1 SHA512
Score

10^/10

discovery trojan banker emotet
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Blacklisted process makes network request
- Executes dropped EXE
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Process spawned unexpected child process

Blacklisted process makes network request

Executes dropped EXE

Checks installed software on the system

Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2