emotet

Sharing

Copy URL Twitter E-mail

General

Target
Dokumente_23_09_2020_7148507587.doc
Size 158KB
Sample200923-92txb2mv16
SHA256 33624b9d31b189eda28dd4ac76bea17844e79f229e8aff90f0a7f0e56ef90860
MD5 ca58c5fd5d453d0fd31e8e51d6f23405
SHA1 a8af228b31de319012ce32687e263ddca87d26cd
SHA512 c5e442d416ed18442e7dc64db52667ae42f79ca61f34ce4e8d93a5b905968c594e89e4b180b92d9f053a0a9ff9f43ba46c3db0062c3813f42487aaf16c1f62db
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Language

Source

URLs

exe.dropper
http://prestokitchens.com/recurringo/fRe/
exe.dropper
http://www.djraisor.com/error/w7G3/
exe.dropper
http://dakarbuzz.net/css/CyKg/
exe.dropper
https://wildecapitalmgmt.net/wp-content/j6/
exe.dropper
http://californiaasa.com/californiaasa.com/8t/
exe.dropper
http://viralbrown.com/e3c0ngfjc/N/
exe.dropper
http://kharazmischl.com/w/

Extracted

Family

emotet

Botnet

Epoch2

108.46.29.236:80
159.203.116.47:8080
173.249.6.108:443
94.124.59.22:8080
94.200.114.161:80
139.130.242.43:80
134.209.36.254:8080
74.208.45.104:8080
139.162.108.71:8080
47.144.21.12:443
95.213.236.64:8080
201.173.217.124:443
85.105.205.77:8080
85.152.162.105:80
153.137.36.142:80
87.106.136.232:8080
87.106.139.101:8080
213.196.135.145:80
67.10.155.92:80
168.235.67.138:7080
157.245.99.39:8080
66.65.136.14:80
62.30.7.67:443
156.155.166.221:80
185.94.252.104:443
209.141.54.221:8080
79.98.24.39:8080
123.176.25.234:80
172.104.97.173:8080
139.162.60.124:8080
74.120.55.163:80
94.1.108.190:443
181.169.34.190:80
220.245.198.194:80
121.7.31.214:80
24.43.32.186:80
104.32.141.43:80
104.131.44.150:8080
68.188.112.97:80
50.35.17.13:80
172.91.208.86:80
37.139.21.175:8080
97.82.79.83:80
200.123.150.89:443
91.211.88.52:7080
104.131.11.150:443
103.86.49.11:8080
89.216.122.92:80
195.7.12.8:80
109.74.5.95:8080
137.119.36.33:80
219.75.128.166:80
137.59.187.107:8080
104.236.246.93:8080
187.161.206.24:80
93.147.212.206:80
71.72.196.159:80
24.179.13.119:80
113.61.66.94:80
121.7.127.163:80
1.221.254.82:80
74.134.41.124:80
24.137.76.62:80
110.145.77.103:80
139.59.60.244:8080
94.23.237.171:443
139.99.158.11:443
216.139.123.119:80
42.200.107.142:80
50.91.114.38:80
75.139.38.211:80
176.111.60.55:8080
162.241.242.173:8080
5.39.91.110:7080
61.19.246.238:443
219.74.18.66:443
46.105.131.79:8080
62.75.141.82:80
82.80.155.43:80
121.124.124.40:7080
188.219.31.12:80
96.249.236.156:443
120.150.60.189:80
124.41.215.226:80
74.219.172.26:80
107.5.122.110:80
83.169.36.251:8080
200.114.213.233:8080
194.187.133.160:443
140.186.212.146:80
5.196.74.210:8080
203.153.216.189:7080
174.45.13.118:80
104.251.33.179:80
78.24.219.147:8080
78.187.156.31:80
190.240.194.77:443
79.137.83.50:443
24.43.99.75:80
37.187.72.193:8080
61.92.17.12:80

rsa_pubkey.plain

Targets

- Target
  Dokumente_23_09_2020_7148507587.doc
- Size 158KB
- SHA256 33624b9d31b189eda28dd4ac76bea17844e79f229e8aff90f0a7f0e56ef90860
- MD5 ca58c5fd5d453d0fd31e8e51d6f23405
- SHA1 a8af228b31de319012ce32687e263ddca87d26cd
- SHA512 c5e442d416ed18442e7dc64db52667ae42f79ca61f34ce4e8d93a5b905968c594e89e4b180b92d9f053a0a9ff9f43ba46c3db0062c3813f42487aaf16c1f62db
- MD5 SHA1 SHA512
Score

10^/10

trojan banker emotet
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Emotet Payload
  Detects Emotet payload in memory.
- Blacklisted process makes network request
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Process spawned unexpected child process

Emotet Payload

Blacklisted process makes network request

Executes dropped EXE

Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2