General
-
Target
14485797cc257a6a0ded3acbbe9cbdb0cfc7ca43ea9c23c35019ac229f70b098.doc
-
Size
169KB
-
Sample
200728-l5f5xxj4ax
-
MD5
ce899c065dce48266034be0125ff39fd
-
SHA1
164d7db08a781722db7028c8165c645fa15a8fe5
-
SHA256
14485797cc257a6a0ded3acbbe9cbdb0cfc7ca43ea9c23c35019ac229f70b098
-
SHA512
23fd06824d121dfb935a35f493faeff9122e8f2205bde0acac0eed92b994a995029cc918d55b321f818561a1de2580d87a2b4f6707ee780fcad3ddbfe19846e6
Malware Config
Extracted
http://globeartdesigners.com/assets/lR/
http://karerguvenlik.com/bayi/6UF4rtEz/
https://juroca.com/language/Uiv/
https://www.lgpass.com/images/Wk128/
http://m0h.net/nano/WLfQ/
Extracted
emotet
Epoch1
179.60.229.168:443
185.94.252.13:443
189.218.165.63:80
77.90.136.129:8080
217.199.160.224:7080
104.131.41.185:8080
2.47.112.152:80
185.94.252.27:443
186.250.52.226:8080
51.255.165.160:8080
68.183.170.114:8080
191.99.160.58:80
104.131.103.37:8080
181.31.211.181:80
202.62.39.111:80
83.169.21.32:7080
87.106.46.107:8080
72.47.248.48:7080
177.75.143.112:443
190.17.195.202:80
Targets
-
-
Target
14485797cc257a6a0ded3acbbe9cbdb0cfc7ca43ea9c23c35019ac229f70b098.doc
-
Size
169KB
-
MD5
ce899c065dce48266034be0125ff39fd
-
SHA1
164d7db08a781722db7028c8165c645fa15a8fe5
-
SHA256
14485797cc257a6a0ded3acbbe9cbdb0cfc7ca43ea9c23c35019ac229f70b098
-
SHA512
23fd06824d121dfb935a35f493faeff9122e8f2205bde0acac0eed92b994a995029cc918d55b321f818561a1de2580d87a2b4f6707ee780fcad3ddbfe19846e6
Score10/10-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Emotet Payload
Detects Emotet payload in memory.
-
Blacklisted process makes network request
-
Executes dropped EXE
-
Drops file in System32 directory
-