General

  • Target

    19633.doc

  • Size

    112KB

  • Sample

    210106-tscncf95de

  • MD5

    66d78e2b8178b341db514213ae161b51

  • SHA1

    79200c539f1a55c1c7ed2a7ad0e8cba72901e521

  • SHA256

    82e92d510859b29c43413bc9f931a3746384e96783916811dbbdaf6cf5122c13

  • SHA512

    fc7931758394f0ba59654039a875fdf34219fdd9a62b6f38b87355ec195e9862393fdf957b5ee21dc8d1d3c40b68444830c9e2e463f13dcaddae6fedcd5a97a0

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://imedu.org/u/cV/

exe.dropper

https://omarisouza.com/cgi-bin/Systems/

exe.dropper

http://eco-mykolaiv.info/f/debug/

exe.dropper

http://smartintelligentsolutions.com/content/microsoft/

exe.dropper

http://ehteknology.com/wp-includes/en-US/

exe.dropper

https://ancorals.com/aminophenol/Stationery/

Extracted

Family

emotet

Botnet

Epoch3

C2

125.0.215.60:80

163.53.204.180:443

89.163.210.141:8080

203.157.152.9:7080

157.245.145.87:443

82.78.179.117:443

85.247.144.202:80

37.46.129.215:8080

110.37.224.243:80

192.210.217.94:8080

2.82.75.215:80

69.159.11.38:443

188.166.220.180:7080

103.93.220.182:80

198.20.228.9:8080

91.75.75.46:80

88.247.30.64:80

189.211.214.19:443

203.160.167.243:80

178.33.167.120:8080

rsa_pubkey.plain

Targets

    • Target

      19633.doc

    • Size

      112KB

    • MD5

      66d78e2b8178b341db514213ae161b51

    • SHA1

      79200c539f1a55c1c7ed2a7ad0e8cba72901e521

    • SHA256

      82e92d510859b29c43413bc9f931a3746384e96783916811dbbdaf6cf5122c13

    • SHA512

      fc7931758394f0ba59654039a875fdf34219fdd9a62b6f38b87355ec195e9862393fdf957b5ee21dc8d1d3c40b68444830c9e2e463f13dcaddae6fedcd5a97a0

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Tasks