Overview

overview

10

Static

static

d45ae96f83...0b.exe

windows7_x64

10

d45ae96f83...0b.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d45ae96f83a29836fcbca8d5d7939c05644437b75bf2c278b676382acbf1ce0b

  • Size

    352KB

  • Sample

    201105-7xwmvfx9j2

  • MD5

    845c1812eb81a42882612e17e85a40be

  • SHA1

    1bd4f31d6e895a0b006f5b850f079e731efa9ed3

  • SHA256

    d45ae96f83a29836fcbca8d5d7939c05644437b75bf2c278b676382acbf1ce0b

  • SHA512

    c2933a33a9914aa809b414bd3a48fbe6b242ff58383d6ea43d094daab7666bf4a80604e999f75e0a682c330cf68379651e712585237d7318d1a640bafe775fff

Score
10/10
emotetepoch3bankerdiscoverytrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

152.32.75.74:443

91.121.200.35:8080

159.203.16.11:8080

188.226.165.170:8080

172.193.79.237:80

123.216.134.52:80

183.91.3.63:80

139.59.61.215:443

185.80.172.199:80

77.74.78.80:443

153.229.219.1:443

113.203.238.130:80

120.51.34.254:80

116.202.10.123:8080

5.2.246.108:80

50.116.78.109:8080

103.80.51.61:8080

190.55.186.229:80

185.142.236.163:443

223.17.215.76:80
rsa_pubkey.plain

Targets

    • Target

      d45ae96f83a29836fcbca8d5d7939c05644437b75bf2c278b676382acbf1ce0b

    • Size

      352KB

    • MD5

      845c1812eb81a42882612e17e85a40be

    • SHA1

      1bd4f31d6e895a0b006f5b850f079e731efa9ed3

    • SHA256

      d45ae96f83a29836fcbca8d5d7939c05644437b75bf2c278b676382acbf1ce0b

    • SHA512

      c2933a33a9914aa809b414bd3a48fbe6b242ff58383d6ea43d094daab7666bf4a80604e999f75e0a682c330cf68379651e712585237d7318d1a640bafe775fff

    Score
    10/10
    emotetepoch3bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet Payload

      Detects Emotet payload in memory.

    • Executes dropped EXE

    • Modifies file permissions

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

1
T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks