General
-
Target
emotet_e4_06012c700c1dac4c122303e920fdf1c71c41e681673c241c9698e5766df275a8_2021-11-17__082839023390._docm
-
Size
140KB
-
Sample
211117-kdkkjahgf8
-
MD5
391dca4cf91ae12aa1b5ac9d0ac3ec41
-
SHA1
47cfcf587d838f68a8f8df53ea3afae475436992
-
SHA256
06012c700c1dac4c122303e920fdf1c71c41e681673c241c9698e5766df275a8
-
SHA512
de299156048c8cb81fe9a5e839442347d118b9de47b353500647a73d4b97f010dcef6d6eb3c7ee9b04874010efd0b9f3b8790f8f9013a47271528eaed1be0c41
Malware Config
Extracted
emotet
Epoch4
91.200.186.228:443
191.252.196.221:8080
94.177.248.64:443
66.42.55.5:7080
103.8.26.103:8080
185.184.25.237:8080
103.8.26.102:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
212.237.17.99:8080
212.237.56.116:7080
216.158.226.206:443
110.232.117.186:8080
Targets
-
-
Target
emotet_e4_06012c700c1dac4c122303e920fdf1c71c41e681673c241c9698e5766df275a8_2021-11-17__082839023390._docm
-
Size
140KB
-
MD5
391dca4cf91ae12aa1b5ac9d0ac3ec41
-
SHA1
47cfcf587d838f68a8f8df53ea3afae475436992
-
SHA256
06012c700c1dac4c122303e920fdf1c71c41e681673c241c9698e5766df275a8
-
SHA512
de299156048c8cb81fe9a5e839442347d118b9de47b353500647a73d4b97f010dcef6d6eb3c7ee9b04874010efd0b9f3b8790f8f9013a47271528eaed1be0c41
Score10/10-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Drops file in System32 directory
-