General

  • Target

    64727558589879.doc

  • Size

    164KB

  • Sample

    210113-dsyzzqxkpe

  • MD5

    f13178e555c973c003788e306283b883

  • SHA1

    d67731968ce308f937eade88a5eadc7fc0c8bb8b

  • SHA256

    184654dabe6d79088d78f855b21b8c4fac22fc263cd0daefa1f6680a43506d52

  • SHA512

    1a8496a1fb6eff9e7c8bd5b1d1523e441de6e99fc66981977d930c79f364c1ad55fd348ae42eda313c891746760abe89d23e14da2401daf26be683896b691791

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://206.189.146.42/wp-admin/F0xAutoConfig/XR9/

exe.dropper

http://paroissesaintabraham.com/wp-admin/H/

exe.dropper

https://lnfch.com/wp-includes/quC/

exe.dropper

https://nahlasolimandesigns.com/wp-admin/0HHK7/

exe.dropper

http://harmonimedia.com/wp-content/uploads/Zol/

exe.dropper

http://ncap.lbatechnologies.com/media/6iQ/

exe.dropper

https://lainiotisllc.com/postauth/7XhB/

Extracted

Family

emotet

Botnet

Epoch2

C2

74.58.215.226:80

24.164.79.147:8080

157.245.123.197:8080

50.116.111.59:8080

173.249.20.233:443

78.188.225.105:80

75.177.207.146:80

136.244.110.184:8080

194.190.67.75:80

70.92.118.112:80

110.145.101.66:443

194.4.58.192:7080

217.20.166.178:7080

109.74.5.95:8080

110.145.11.73:80

66.57.108.14:443

78.189.148.42:80

144.217.7.207:7080

120.150.60.189:80

37.139.21.175:8080

rsa_pubkey.plain

Targets

    • Target

      64727558589879.doc

    • Size

      164KB

    • MD5

      f13178e555c973c003788e306283b883

    • SHA1

      d67731968ce308f937eade88a5eadc7fc0c8bb8b

    • SHA256

      184654dabe6d79088d78f855b21b8c4fac22fc263cd0daefa1f6680a43506d52

    • SHA512

      1a8496a1fb6eff9e7c8bd5b1d1523e441de6e99fc66981977d930c79f364c1ad55fd348ae42eda313c891746760abe89d23e14da2401daf26be683896b691791

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Tasks