Overview

overview

10

Static

static

8

ST_Heodo_S...ze.doc

windows7_x64

10

ST_Heodo_S...ze.doc

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ST_Heodo_ST_2021-01-05_19-42-08-628.eml_20210105Auftrag.doc_analyze.doc

  • Size

    143KB

  • Sample

    210106-af33nj68sx

  • MD5

    b65dfb31fa424584160c388da6a063a6

  • SHA1

    b0167ddce3fc7580b29f19d4e82e1aaa69edacc4

  • SHA256

    8cfb715353dbbbc60a56ac17fcd804e76515221f520154f994a76e8909a403f7

  • SHA512

    afcb110f6dfceb31be600f862657737c82c95a45c297ab4e5715a60cb8703847734c63cc9c7dd1dd6198bf51fee91c6e25d185c2a2cb69ff6df1cf61bf1ccc23

Score
10/10
emotetepoch3bankermacrotrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://obob.tv/content/rpKmYv/
exe.dropper

http://infoprocenter.com/wp-admin/MSInfo/
exe.dropper

http://miprimercamino.com/cgi-bin/AJ09AzChrK/
exe.dropper

http://mobilepro-tm.online/wp-admin/VGX/
exe.dropper

https://www.terrakulturegallery.com/wp-admin/ZNg6V7pv/
exe.dropper

http://bingdaofuzhu.com/wp-content/L/

Extracted

Family

emotet

Botnet

Epoch3

C2

125.0.215.60:80

163.53.204.180:443

89.163.210.141:8080

203.157.152.9:7080

157.245.145.87:443

82.78.179.117:443

85.247.144.202:80

37.46.129.215:8080

110.37.224.243:80

192.210.217.94:8080

2.82.75.215:80

69.159.11.38:443

188.166.220.180:7080

103.93.220.182:80

198.20.228.9:8080

91.75.75.46:80

88.247.30.64:80

189.211.214.19:443

203.160.167.243:80

178.33.167.120:8080
rsa_pubkey.plain

Targets

    • Target

      ST_Heodo_ST_2021-01-05_19-42-08-628.eml_20210105Auftrag.doc_analyze.doc

    • Size

      143KB

    • MD5

      b65dfb31fa424584160c388da6a063a6

    • SHA1

      b0167ddce3fc7580b29f19d4e82e1aaa69edacc4

    • SHA256

      8cfb715353dbbbc60a56ac17fcd804e76515221f520154f994a76e8909a403f7

    • SHA512

      afcb110f6dfceb31be600f862657737c82c95a45c297ab4e5715a60cb8703847734c63cc9c7dd1dd6198bf51fee91c6e25d185c2a2cb69ff6df1cf61bf1ccc23

    Score
    10/10
    emotetepoch3bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks