Overview

overview

10

Static

static

8

emotet_e3_...oc.doc

windows7_x64

10

emotet_e3_...oc.doc

windows10_x64

Sharing

Copy URL Twitter E-mail

General

  • Target
    emotet_e3_e138a2d8f76c4e6fea232fce64cf92aaa0e8ad25dc803478feb65bf7e4c0f1ab_2020-08-20__001203._doc
  • Size 200KB
  • Sample200820-d3pjtp5bsa
  • SHA256 e138a2d8f76c4e6fea232fce64cf92aaa0e8ad25dc803478feb65bf7e4c0f1ab
  • MD5 SHA1 SHA512
Score
10/10
emotetepoch3bankermacrotrojan

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://cahayu.id/wp-includes/jSi7Fd1r2wtg64969/
  • exe.dropper

    https://anhung1102.vn/wp-admin/LtirUcNdN/
  • exe.dropper

    https://idan-online.co.il/wp-admin/PPf124q2l26832/
  • exe.dropper

    http://www.canfrec.com.mx/4swBvrmkkp/VqcoomQpd/
  • exe.dropper

    http://dhartiproject.mysquare.in/temp/ZJd8p5u49737132/
  • exe.dropper

    https://lokeshullamkecskemet.hu/mail/Jnilw/
  • exe.dropper

    http://armonimalatya.com/dermatomic/77qo1g74024/

Extracted

Family

  • emotet

Botnet

  • Epoch3

C2

  • 173.94.215.84:80

  • 85.25.207.108:8080

  • 178.128.14.92:8080

  • 60.125.114.64:443

  • 181.126.54.234:80

  • 157.7.164.178:8081

  • 95.216.205.155:8080

  • 216.75.37.196:8080

  • 179.62.238.49:80

  • 71.57.180.213:80

  • 172.96.190.154:8080

  • 112.78.142.170:80

  • 178.238.232.46:443

  • 177.144.130.105:443

  • 105.209.235.113:8080

  • 46.105.131.68:8080

  • 185.86.148.68:443

  • 143.95.101.72:8080

  • 75.127.14.170:8080

  • 168.0.97.6:80

rsa_pubkey.plain

Targets

    • Target
      emotet_e3_e138a2d8f76c4e6fea232fce64cf92aaa0e8ad25dc803478feb65bf7e4c0f1ab_2020-08-20__001203._doc
    • Size 200KB
    • SHA256 e138a2d8f76c4e6fea232fce64cf92aaa0e8ad25dc803478feb65bf7e4c0f1ab
    • MD5 SHA1 SHA512
    Score
    10/10
    trojanbankeremotet

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Emotet Payload

      Detects Emotet payload in memory.

    • Blacklisted process makes network request

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks