General

  • Target

    DOK 2912 122020 2814729328.doc

  • Size

    163KB

  • Sample

    210108-zncz78x9fa

  • MD5

    883c20208c0f142c63449d4c73d33bbb

  • SHA1

    d7bfb118abac96d9bae82cd5d70ded63888bc4c6

  • SHA256

    3674fccc1fcd91cc653d64126a338bb297ee3c7da980703ba400b45e2f6f3b70

  • SHA512

    71eb782a1da5cc7df1d18449adabfa587dc43e48768c71a542904603cb20338b4c9c03dfac5e441a6ce01e3e07be5a34f4508092402c20ee61df6be69d200693

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://206.189.146.42/wp-admin/F0xAutoConfig/XR9/

exe.dropper

http://paroissesaintabraham.com/wp-admin/H/

exe.dropper

https://lnfch.com/wp-includes/quC/

exe.dropper

https://nahlasolimandesigns.com/wp-admin/0HHK7/

exe.dropper

http://harmonimedia.com/wp-content/uploads/Zol/

exe.dropper

http://ncap.lbatechnologies.com/media/6iQ/

exe.dropper

https://lainiotisllc.com/postauth/7XhB/

Extracted

Family

emotet

Botnet

Epoch2

C2

74.58.215.226:80

24.164.79.147:8080

157.245.123.197:8080

50.116.111.59:8080

173.249.20.233:443

78.188.225.105:80

75.177.207.146:80

136.244.110.184:8080

194.190.67.75:80

70.92.118.112:80

110.145.101.66:443

194.4.58.192:7080

217.20.166.178:7080

109.74.5.95:8080

110.145.11.73:80

66.57.108.14:443

78.189.148.42:80

144.217.7.207:7080

120.150.60.189:80

37.139.21.175:8080

rsa_pubkey.plain

Targets

    • Target

      DOK 2912 122020 2814729328.doc

    • Size

      163KB

    • MD5

      883c20208c0f142c63449d4c73d33bbb

    • SHA1

      d7bfb118abac96d9bae82cd5d70ded63888bc4c6

    • SHA256

      3674fccc1fcd91cc653d64126a338bb297ee3c7da980703ba400b45e2f6f3b70

    • SHA512

      71eb782a1da5cc7df1d18449adabfa587dc43e48768c71a542904603cb20338b4c9c03dfac5e441a6ce01e3e07be5a34f4508092402c20ee61df6be69d200693

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Tasks