d297c0a4c89de58051ca734994c514d423a71d1a0fcad5c1da9a76f402bd3bbe

Target

Size

164KB

Sample

210211-w1trhbajaj

Score

10 ^/10

MD5

02b2dee96e10003270606dfd7e059d23

SHA1

defe94b8ae07e6c5db6942bc7d020b615c4ba75d

SHA256

d297c0a4c89de58051ca734994c514d423a71d1a0fcad5c1da9a76f402bd3bbe

SHA512

4ebd0002c4c75788efdcd928d86da802c0a7d7152e96d6d900c72c656e14fbe62562aa8dff5f409ef1c158fb36c3e05a065c07093b104d3ae10e7ff0cc7c02a4

Extracted

Language	ps1
Deobfuscated
URLs	http://www.achutamanasa.com/media/Te/ http://opticaquilin.cl/wp-includes/FFueL/ https://www.infoquick.co.uk/assets/h/ http://vilajansen.com.br/loja_old_1/p/ http://oftalmovilaplana.com/wp-includes/wfKu/ https://cashyinvestment.org/wp-content/21dIZ/ http://merkadito.mx/upload/6/ exe.dropper http://www.achutamanasa.com/media/Te/ exe.dropper http://opticaquilin.cl/wp-includes/FFueL/ exe.dropper https://www.infoquick.co.uk/assets/h/ exe.dropper http://vilajansen.com.br/loja_old_1/p/ exe.dropper http://oftalmovilaplana.com/wp-includes/wfKu/ exe.dropper https://cashyinvestment.org/wp-content/21dIZ/ exe.dropper http://merkadito.mx/upload/6/

Extracted

Family	emotet
Botnet	Epoch2
C2	12.175.220.98:80 162.241.204.233:8080 50.116.111.59:8080 172.86.188.251:8080 139.99.158.11:443 66.57.108.14:443 75.177.207.146:80 194.190.67.75:80 50.245.107.73:443 173.70.61.180:80 85.105.205.77:8080 104.131.11.150:443 62.75.141.82:80 70.92.118.112:80 194.4.58.192:7080 120.150.60.189:80 24.231.88.85:80 78.24.219.147:8080 110.142.236.207:80 119.59.116.21:8080 144.217.7.207:7080 95.213.236.64:8080 46.105.131.79:8080 176.111.60.55:8080 174.118.202.24:443 94.23.237.171:443 138.68.87.218:443 110.145.101.66:443 134.209.144.106:443 74.208.45.104:8080 24.178.90.49:80 172.125.40.123:80 157.245.99.39:8080 118.83.154.64:443 202.134.4.211:8080 121.124.124.40:7080 172.104.97.173:8080 110.145.11.73:80 172.105.13.66:443 168.235.67.138:7080 78.188.225.105:80 59.21.235.119:80 185.94.252.104:443 24.179.13.119:80 49.205.182.134:80 51.89.36.180:443 115.21.224.117:80 202.134.4.216:8080 190.251.200.206:80 78.189.148.42:80 220.245.198.194:80 85.105.111.166:80 5.39.91.110:7080 203.153.216.189:7080 93.146.48.84:80 181.165.68.127:80 70.183.211.3:80 47.144.21.37:80 167.114.153.111:8080 75.109.111.18:80 24.69.65.8:8080 188.165.214.98:8080 187.161.206.24:80 74.58.215.226:80 74.128.121.17:80 24.164.79.147:8080 139.59.60.244:8080 136.244.110.184:8080 2.58.16.89:8080 79.137.83.50:443 139.162.60.124:8080 89.216.122.92:80 188.219.31.12:80 190.103.228.24:80 109.74.5.95:8080 87.106.139.101:8080 78.182.254.231:80 74.40.205.197:443 89.106.251.163:80 69.49.88.46:80 62.171.142.179:8080 217.20.166.178:7080 161.0.153.60:80 37.187.72.193:8080 190.240.194.77:443 5.2.212.254:80 200.116.145.225:443 98.109.133.80:80 75.113.193.72:80 115.94.207.99:443 109.116.245.80:80 123.176.25.234:80 120.150.218.241:443 50.91.114.38:80 180.222.161.85:80 186.74.215.34:80 95.9.5.93:80 64.207.182.168:8080 197.211.245.21:80 61.19.246.238:443 37.139.21.175:8080 181.171.209.241:443 185.201.9.197:8080 71.72.196.159:80 41.185.28.84:8080 12.175.220.98:80 162.241.204.233:8080 50.116.111.59:8080 172.86.188.251:8080 139.99.158.11:443 66.57.108.14:443 75.177.207.146:80 194.190.67.75:80 50.245.107.73:443 173.70.61.180:80 85.105.205.77:8080 104.131.11.150:443 62.75.141.82:80 70.92.118.112:80 194.4.58.192:7080 120.150.60.189:80 24.231.88.85:80 78.24.219.147:8080 110.142.236.207:80 119.59.116.21:8080 144.217.7.207:7080 95.213.236.64:8080 46.105.131.79:8080 176.111.60.55:8080 174.118.202.24:443 94.23.237.171:443 138.68.87.218:443 110.145.101.66:443 134.209.144.106:443 74.208.45.104:8080 24.178.90.49:80 172.125.40.123:80 157.245.99.39:8080 118.83.154.64:443 202.134.4.211:8080 121.124.124.40:7080 172.104.97.173:8080 110.145.11.73:80 172.105.13.66:443 168.235.67.138:7080 78.188.225.105:80 59.21.235.119:80 185.94.252.104:443 24.179.13.119:80 49.205.182.134:80 51.89.36.180:443 115.21.224.117:80 202.134.4.216:8080 190.251.200.206:80 78.189.148.42:80 220.245.198.194:80 85.105.111.166:80 5.39.91.110:7080 203.153.216.189:7080 93.146.48.84:80 181.165.68.127:80 70.183.211.3:80 47.144.21.37:80 167.114.153.111:8080 75.109.111.18:80 24.69.65.8:8080 188.165.214.98:8080 187.161.206.24:80 74.58.215.226:80 74.128.121.17:80 24.164.79.147:8080 139.59.60.244:8080 136.244.110.184:8080 2.58.16.89:8080 79.137.83.50:443 139.162.60.124:8080 89.216.122.92:80 188.219.31.12:80 190.103.228.24:80 109.74.5.95:8080 87.106.139.101:8080 78.182.254.231:80 74.40.205.197:443 89.106.251.163:80 69.49.88.46:80 62.171.142.179:8080 217.20.166.178:7080 161.0.153.60:80 37.187.72.193:8080 190.240.194.77:443 5.2.212.254:80 200.116.145.225:443 98.109.133.80:80 75.113.193.72:80 115.94.207.99:443 109.116.245.80:80 123.176.25.234:80 120.150.218.241:443 50.91.114.38:80 180.222.161.85:80 186.74.215.34:80 95.9.5.93:80 64.207.182.168:8080 197.211.245.21:80 61.19.246.238:443 37.139.21.175:8080 181.171.209.241:443 185.201.9.197:8080 71.72.196.159:80 41.185.28.84:8080
rsa_pubkey.plain

Target

d297c0a4c89de58051ca734994c514d423a71d1a0fcad5c1da9a76f402bd3bbe

MD5

02b2dee96e10003270606dfd7e059d23

Filesize

164KB

Score

10^/10

SHA1

defe94b8ae07e6c5db6942bc7d020b615c4ba75d

SHA256

d297c0a4c89de58051ca734994c514d423a71d1a0fcad5c1da9a76f402bd3bbe

SHA512

4ebd0002c4c75788efdcd928d86da802c0a7d7152e96d6d900c72c656e14fbe62562aa8dff5f409ef1c158fb36c3e05a065c07093b104d3ae10e7ff0cc7c02a4

Signatures

Emotet
Description

Emotet is a trojan that is primarily spread through spam emails.
Tags

trojan banker emotet
Process spawned unexpected child process
Description

This typically indicates the parent process was compromised via an exploit or macro.
Blocklisted process makes network request
Loads dropped DLL
Drops file in System32 directory
Enumerates physical storage devices
Description

Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
TTPs

System Information Discovery

Related Tasks

behavioral1 behavioral2

Collection

Command and Control

Credential Access

Defense Evasion

Modify Registry

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

static1

macro xlm

8^/10

behavioral1

emotet epoch2 banker trojan

10^/10

behavioral2

10^/10

Extracted

Extracted

Tags

Signatures

Emotet

Description

Tags

Process spawned unexpected child process

Description

Blocklisted process makes network request

Loads dropped DLL

Drops file in System32 directory

Enumerates physical storage devices

Description

TTPs

Related Tasks

static1

behavioral1

behavioral2