emotet

General

Target

emotet_e1_bd5cbc8583305658dc0266f8fbfced9e57e41d459fb3120bff3df95fcacccba9_2020-07-28__222610._doc
Size

170KB
Sample

200728-qeh9kplmmj
MD5

ddbb140f4b29ab0e415b312c8824e7ff
SHA1

03509a17c34d900e9d4ebaf218b50e1a50a0de67
SHA256

bd5cbc8583305658dc0266f8fbfced9e57e41d459fb3120bff3df95fcacccba9
SHA512

eabdb62f0e17f7d719c78ce9e2b2de49429ba15abae30349bee924067322d06136872a27f508ba81766e20e5714245819206f9d310285652ab421c86e3a5a99a

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

http://arizonaonsale.com/cgi-bin/VuM64/

exe.dropper

https://www.compednet.com/wp-content/Nv55027/

exe.dropper

http://eltallerartistico.com/language/Uybj0/

exe.dropper

http://classicpaint.net/wp-content/tVS1/

exe.dropper

http://closhlab.com/OWN/lUvYIzLMa/

Extracted

Family

emotet

Botnet

Epoch1

C2

179.60.229.168:443

185.94.252.13:443

189.218.165.63:80

77.90.136.129:8080

217.199.160.224:7080

104.131.41.185:8080

2.47.112.152:80

185.94.252.27:443

186.250.52.226:8080

51.255.165.160:8080

68.183.170.114:8080

191.99.160.58:80

104.131.103.37:8080

181.31.211.181:80

202.62.39.111:80

83.169.21.32:7080

87.106.46.107:8080

72.47.248.48:7080

177.75.143.112:443

190.17.195.202:80

rsa_pubkey.plain

Targets

- Target
  
  emotet_e1_bd5cbc8583305658dc0266f8fbfced9e57e41d459fb3120bff3df95fcacccba9_2020-07-28__222610._doc
- Size
  
  170KB
- MD5
  
  ddbb140f4b29ab0e415b312c8824e7ff
- SHA1
  
  03509a17c34d900e9d4ebaf218b50e1a50a0de67
- SHA256
  
  bd5cbc8583305658dc0266f8fbfced9e57e41d459fb3120bff3df95fcacccba9
- SHA512
  
  eabdb62f0e17f7d719c78ce9e2b2de49429ba15abae30349bee924067322d06136872a27f508ba81766e20e5714245819206f9d310285652ab421c86e3a5a99a
Score

10^/10

trojan banker emotet
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Emotet Payload
  Detects Emotet payload in memory.
- Blacklisted process makes network request
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Process spawned unexpected child process

Emotet Payload

Blacklisted process makes network request

Executes dropped EXE

Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2