Overview

overview

10

Static

static

8

emotet_doc2

windows10_x64

10

emotet_doc

windows10_x64

10

Resubmissions

21/12/2020, 16:05

201221-63d1a5ry2n10

21/12/2020, 16:04

201221-w6dwvwcaza10

21/12/2020, 12:05

201221-8c6wmat6kx10

Sharing

Copy URL Twitter E-mail

General

  • Target
    5750416374792192.zip
  • Size 93KB
  • Sample201221-8c6wmat6kx
  • SHA256 a5b510a8622fa550ad9b0a48d4201e286b1f446aa6fb78c5b4274c11a07ff4d0
  • MD5 SHA1 SHA512
Score
10/10
emotetepoch1bankermacrotrojan

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://parakkunnathtemple.com/bckup/7SDAvi/
  • exe.dropper

    http://helionspharmaceutical.com/wp-admin/oXJB/
  • exe.dropper

    https://accordiblehr.com/wp-admin/HdzyEn/
  • exe.dropper

    https://snjwellers.com/wp-includes/esttW/
  • exe.dropper

    https://norailya.com/vendor/1j/
  • exe.dropper

    https://whytech.info/wp-includes/HceUxFK/
  • exe.dropper

    http://resuco.net/wp-content/uploads/2020/12/S0K/

Extracted

Family

  • emotet

Botnet

  • Epoch1

C2

  • 95.76.153.115:80

  • 191.241.233.198:80

  • 167.71.148.58:443

  • 211.215.18.93:8080

  • 1.234.65.61:80

  • 60.93.23.51:80

  • 51.15.7.145:80

  • 190.24.243.186:80

  • 190.64.88.186:443

  • 186.146.13.184:443

  • 177.85.167.10:80

  • 59.148.253.194:8080

  • 155.186.9.160:80

  • 51.255.165.160:8080

  • 149.202.72.142:7080

  • 111.67.12.221:8080

  • 185.183.16.47:80

  • 111.67.12.222:8080

  • 190.195.129.227:8090

  • 71.58.233.254:80

rsa_pubkey.plain

Targets

    • Target
      e6e59fd682d1212c1b789365f92e5a5e778ca20f2d16440ec6f5b46ddb85d431
    • Size 190KB
    • SHA256 e6e59fd682d1212c1b789365f92e5a5e778ca20f2d16440ec6f5b46ddb85d431
    • MD5 SHA1 SHA512
    Score
    10/10
    emotetepoch1bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks