Overview

overview

10

Static

static

8

emotet_e3_...oc.doc

windows7_x64

10

emotet_e3_...oc.doc

windows10_x64

Sharing

Copy URL Twitter E-mail

General

  • Target
    emotet_e3_3ca4673735b5baa8bcbccb8f4fc744a0da8fd4074ea63f2180b04b26742dc3a5_2020-08-12__160405._doc
  • Size 228KB
  • Sample200812-wp5k7y7yn6
  • SHA256 3ca4673735b5baa8bcbccb8f4fc744a0da8fd4074ea63f2180b04b26742dc3a5
  • MD5 SHA1 SHA512
Score
10/10
emotetepoch3bankermacrotrojan

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://www.popfizzion.com/wp-content/zcek347/
  • exe.dropper

    http://uniteddatabase.net/wp-content/QMqmK/
  • exe.dropper

    http://utah211.org/prototype/VAOWTSmQ/
  • exe.dropper

    http://www.duhallow.com/wp-content/0BmNgw0vb6ls79217572/
  • exe.dropper

    https://dubai-homes.ae/wp-admin/jlnlcp0uy616621042/

Extracted

Family

  • emotet

Botnet

  • Epoch3

C2

  • 176.216.226.44:80

  • 159.203.232.29:8080

  • 185.86.148.68:443

  • 97.104.107.190:80

  • 178.33.167.120:8080

  • 46.105.131.68:8080

  • 78.189.60.109:443

  • 198.57.203.63:8080

  • 153.220.182.49:80

  • 143.95.101.72:8080

  • 105.213.67.88:80

  • 203.153.216.182:7080

  • 77.74.78.80:443

  • 185.208.226.142:8080

  • 188.251.213.180:443

  • 192.163.221.191:8080

  • 172.105.78.244:8080

  • 50.116.78.109:8080

  • 46.32.229.152:8080

  • 201.235.10.215:80

rsa_pubkey.plain

Targets

    • Target
      emotet_e3_3ca4673735b5baa8bcbccb8f4fc744a0da8fd4074ea63f2180b04b26742dc3a5_2020-08-12__160405._doc
    • Size 228KB
    • SHA256 3ca4673735b5baa8bcbccb8f4fc744a0da8fd4074ea63f2180b04b26742dc3a5
    • MD5 SHA1 SHA512
    Score
    10/10
    trojanbankeremotet

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Emotet Payload

      Detects Emotet payload in memory.

    • Blacklisted process makes network request

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks