General

  • Target

    MAIL-0573188.doc

  • Size

    165KB

  • Sample

    210107-qgnvmnngqj

  • MD5

    7ad5e41d03b2dfe72af417fa5b0cc164

  • SHA1

    2a6c0fa93aba9ce560d271ce65d79db69422fc6c

  • SHA256

    2d6cbcbc803638a13705a3b26afb3b34b72bc58601215566ba858c62882b8e61

  • SHA512

    83bc8a65c0316660f42a6d3cd4ed7e7432dd939ffa4b408f1f40d59cf2c7a842271a19b21308d5bc56de0ff382b9db7e8e05ff159e332588e02ca50b762a4ca8

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://wpsapk.com/wp-admin/v/

exe.dropper

http://sofsuite.com/wp-includes/2jm3nIk/

exe.dropper

http://veterinariadrpopui.com/content/5f18Q/

exe.dropper

http://shop.elemenslide.com/wp-content/n/

exe.dropper

http://khanhhoahomnay.net/wordpress/CGMC/

exe.dropper

http://campusexpo.org/department-of-odhmmkd/95eXZY/

exe.dropper

https://gurztac.wtchevalier.com/wp-content/YzZ6YZ/

Extracted

Family

emotet

Botnet

Epoch1

C2

5.2.136.90:80

186.147.237.3:8080

138.197.99.250:8080

167.71.148.58:443

211.215.18.93:8080

187.162.248.237:80

1.226.84.243:8080

110.39.160.38:443

5.196.35.138:7080

59.148.253.194:8080

45.16.226.117:443

95.76.153.115:80

181.61.182.143:80

46.43.2.95:8080

188.135.15.49:80

81.215.230.173:443

45.4.32.50:80

81.214.253.80:443

94.176.234.118:443

212.71.237.140:8080

rsa_pubkey.plain

Targets

    • Target

      MAIL-0573188.doc

    • Size

      165KB

    • MD5

      7ad5e41d03b2dfe72af417fa5b0cc164

    • SHA1

      2a6c0fa93aba9ce560d271ce65d79db69422fc6c

    • SHA256

      2d6cbcbc803638a13705a3b26afb3b34b72bc58601215566ba858c62882b8e61

    • SHA512

      83bc8a65c0316660f42a6d3cd4ed7e7432dd939ffa4b408f1f40d59cf2c7a842271a19b21308d5bc56de0ff382b9db7e8e05ff159e332588e02ca50b762a4ca8

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Tasks