General

  • Target

    DAT_29_12_2020.doc

  • Size

    164KB

  • Sample

    210113-pnsp9x77bs

  • MD5

    734b3785978b6a3e545d0c2e54feebe9

  • SHA1

    78b40c1e13ec5cc8e98fa3b629fe23f5df182326

  • SHA256

    b1ccfa373dfcf601e71eef31344b0d0101f33dc8b9e4b2a9b8ca797799b02193

  • SHA512

    822ee2579a87ac76325702fdf1f4c891b7223b151202d727df9cd36ed28f6332510f985e6959d82f74cdccf69c484233f21d3a48d35c3b3e3a7406ac92e4484f

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://206.189.146.42/wp-admin/F0xAutoConfig/XR9/

exe.dropper

http://paroissesaintabraham.com/wp-admin/H/

exe.dropper

https://lnfch.com/wp-includes/quC/

exe.dropper

https://nahlasolimandesigns.com/wp-admin/0HHK7/

exe.dropper

http://harmonimedia.com/wp-content/uploads/Zol/

exe.dropper

http://ncap.lbatechnologies.com/media/6iQ/

exe.dropper

https://lainiotisllc.com/postauth/7XhB/

Extracted

Family

emotet

Botnet

Epoch2

C2

74.58.215.226:80

24.164.79.147:8080

157.245.123.197:8080

50.116.111.59:8080

173.249.20.233:443

78.188.225.105:80

75.177.207.146:80

136.244.110.184:8080

194.190.67.75:80

70.92.118.112:80

110.145.101.66:443

194.4.58.192:7080

217.20.166.178:7080

109.74.5.95:8080

110.145.11.73:80

66.57.108.14:443

78.189.148.42:80

144.217.7.207:7080

120.150.60.189:80

37.139.21.175:8080

rsa_pubkey.plain

Targets

    • Target

      DAT_29_12_2020.doc

    • Size

      164KB

    • MD5

      734b3785978b6a3e545d0c2e54feebe9

    • SHA1

      78b40c1e13ec5cc8e98fa3b629fe23f5df182326

    • SHA256

      b1ccfa373dfcf601e71eef31344b0d0101f33dc8b9e4b2a9b8ca797799b02193

    • SHA512

      822ee2579a87ac76325702fdf1f4c891b7223b151202d727df9cd36ed28f6332510f985e6959d82f74cdccf69c484233f21d3a48d35c3b3e3a7406ac92e4484f

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Tasks