General
-
Target
2782 N 57ST.doc
-
Size
164KB
-
Sample
210113-2qnjcfwrf2
-
MD5
1d304176531b0fcbd4b01b06a66c4a7f
-
SHA1
2e86142d343e2e55ef135b8e4a0b5545cd890f9f
-
SHA256
d8ff63c249a4c63851ef1f033be0dc23f85e88273cc88534015cf61ca771ef88
-
SHA512
49330db50a3ed671f5af0b06ed1632c113e6e258a5dd93d8955cae5f3a789166020a28db4198793c14dcc8843a9984abec17e9fa801003f1cb9b96bc4b100f36
Malware Config
Extracted
http://206.189.146.42/wp-admin/F0xAutoConfig/XR9/
http://paroissesaintabraham.com/wp-admin/H/
https://lnfch.com/wp-includes/quC/
https://nahlasolimandesigns.com/wp-admin/0HHK7/
http://harmonimedia.com/wp-content/uploads/Zol/
http://ncap.lbatechnologies.com/media/6iQ/
https://lainiotisllc.com/postauth/7XhB/
Extracted
emotet
Epoch2
74.58.215.226:80
24.164.79.147:8080
157.245.123.197:8080
50.116.111.59:8080
173.249.20.233:443
78.188.225.105:80
75.177.207.146:80
136.244.110.184:8080
194.190.67.75:80
70.92.118.112:80
110.145.101.66:443
194.4.58.192:7080
217.20.166.178:7080
109.74.5.95:8080
110.145.11.73:80
66.57.108.14:443
78.189.148.42:80
144.217.7.207:7080
120.150.60.189:80
37.139.21.175:8080
Targets
-
-
Target
2782 N 57ST.doc
-
Size
164KB
-
MD5
1d304176531b0fcbd4b01b06a66c4a7f
-
SHA1
2e86142d343e2e55ef135b8e4a0b5545cd890f9f
-
SHA256
d8ff63c249a4c63851ef1f033be0dc23f85e88273cc88534015cf61ca771ef88
-
SHA512
49330db50a3ed671f5af0b06ed1632c113e6e258a5dd93d8955cae5f3a789166020a28db4198793c14dcc8843a9984abec17e9fa801003f1cb9b96bc4b100f36
Score10/10-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Loads dropped DLL
-
Drops file in System32 directory
-