Overview

overview

10

Static

static

8

송장-171827.doc

windows7_x64

10

송장-171827.doc

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    송장-171827.doc

  • Size

    164KB

  • Sample

    210129-ej83cc3yhx

  • MD5

    cca2eb43e9ac9ce0b850601db0c8a9dd

  • SHA1

    1efa00d6971122dfe4e916282085e1e4ca0eeb86

  • SHA256

    b2de95f9cba002fd980b4edb6ca033c5c200f4f1cea9d7a7315cfa4801e514e0

  • SHA512

    1d3c28189386daaa494ab871c7a534b4054ddd3fb91a60a5baf8abc6c961fd34c880feac43b806bbb64fa46588faba5b6f2c15879d355b5d810b24d6b91e8005

Score
10/10
emotetepoch3bankermacroransomwaretrojanxlm

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://qingniatouzi.com/wp-includes/Z4TFME0/
exe.dropper

http://chenqiaorong007.com/wp-content/inh1Q4eFMT/
exe.dropper

http://bestcartdeal.com/wp-content/U12BbGPx2v/
exe.dropper

https://hredoybangladesh.com/3948708181/l7/
exe.dropper

https://washcolsc.com/wp-admin/gRIWZ/
exe.dropper

https://aqnym.top/wp-login/9ZvtYaLyhg/

Extracted

Family

emotet

Botnet

Epoch3

C2

132.248.38.158:80

203.157.152.9:7080

157.245.145.87:443

110.37.224.243:80

70.32.89.105:8080

185.142.236.163:443

192.241.220.183:8080

91.83.93.103:443

54.38.143.245:8080

192.210.217.94:8080

37.205.9.252:7080

78.90.78.210:80

182.73.7.59:8080

163.53.204.180:443

91.75.75.46:80

172.104.46.84:8080

161.49.84.2:80

27.78.27.110:443

203.160.167.243:80

109.99.146.210:8080
rsa_pubkey.plain

Targets

    • Target

      송장-171827.doc

    • Size

      164KB

    • MD5

      cca2eb43e9ac9ce0b850601db0c8a9dd

    • SHA1

      1efa00d6971122dfe4e916282085e1e4ca0eeb86

    • SHA256

      b2de95f9cba002fd980b4edb6ca033c5c200f4f1cea9d7a7315cfa4801e514e0

    • SHA512

      1d3c28189386daaa494ab871c7a534b4054ddd3fb91a60a5baf8abc6c961fd34c880feac43b806bbb64fa46588faba5b6f2c15879d355b5d810b24d6b91e8005

    Score
    10/10
    emotetepoch3bankerransomwaretrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Drops file in System32 directory

    • Enumerates physical storage devices

      Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks