General

  • Target

    dati-122020.doc

  • Size

    163KB

  • Sample

    210113-c98tkm7lpn

  • MD5

    a00b6d3f7b8f019a42b3d7c5c5652134

  • SHA1

    4810219ad0ff3a0314f27c3e31c39a0f6d5558a6

  • SHA256

    f7aeb3239c5f65d2fbd4e934bbd637cd8751ccd6f8c31be5242df356cfef44dd

  • SHA512

    bf5ae34e07c371637bba0b7418ced987cf3c318649dd2afdc7a1bbd50d137bfaf8739d99f42f47e05a5634ee56734b18691f6811f7fe264a7560ec3db973907e

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://206.189.146.42/wp-admin/F0xAutoConfig/XR9/

exe.dropper

http://paroissesaintabraham.com/wp-admin/H/

exe.dropper

https://lnfch.com/wp-includes/quC/

exe.dropper

https://nahlasolimandesigns.com/wp-admin/0HHK7/

exe.dropper

http://harmonimedia.com/wp-content/uploads/Zol/

exe.dropper

http://ncap.lbatechnologies.com/media/6iQ/

exe.dropper

https://lainiotisllc.com/postauth/7XhB/

Extracted

Family

emotet

Botnet

Epoch2

C2

74.58.215.226:80

24.164.79.147:8080

157.245.123.197:8080

50.116.111.59:8080

173.249.20.233:443

78.188.225.105:80

75.177.207.146:80

136.244.110.184:8080

194.190.67.75:80

70.92.118.112:80

110.145.101.66:443

194.4.58.192:7080

217.20.166.178:7080

109.74.5.95:8080

110.145.11.73:80

66.57.108.14:443

78.189.148.42:80

144.217.7.207:7080

120.150.60.189:80

37.139.21.175:8080

rsa_pubkey.plain

Targets

    • Target

      dati-122020.doc

    • Size

      163KB

    • MD5

      a00b6d3f7b8f019a42b3d7c5c5652134

    • SHA1

      4810219ad0ff3a0314f27c3e31c39a0f6d5558a6

    • SHA256

      f7aeb3239c5f65d2fbd4e934bbd637cd8751ccd6f8c31be5242df356cfef44dd

    • SHA512

      bf5ae34e07c371637bba0b7418ced987cf3c318649dd2afdc7a1bbd50d137bfaf8739d99f42f47e05a5634ee56734b18691f6811f7fe264a7560ec3db973907e

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Tasks