Overview

overview

10

Static

static

8

14bb08d9ec...2.xlsm

windows7_x64

10

14bb08d9ec...2.xlsm

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    14bb08d9ec0d0c38ff6ab01fed57e9c5209039d2.xlsm

  • Size

    101KB

  • Sample

    211211-krml2sbad7

  • MD5

    357ab6e63b88762a709c7a4aa09f873b

  • SHA1

    14bb08d9ec0d0c38ff6ab01fed57e9c5209039d2

  • SHA256

    6ea0ad9cbb68fccd68b45f23ceb055ceb2decd4e17185bdc49e4e4ba213a2b3b

  • SHA512

    83bfa6fda00911f7ebf0ec0449db87f8e90cbdac840d55e93eaa66a1773ab11665519fae04272c939bfad320cdc99ac2cc998d60d1d46fb79506aa531a980191

Score
10/10
emotetepoch5bankermacrotrojanxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://pilotscience.com/Halimat/1VODveKhzNICs/
xlm40.dropper

http://monorailegypt.com/wp-admin/36tiKwe85v3/

Extracted

Family

emotet

Botnet

Epoch5

C2

209.239.112.82:8080

116.124.128.206:8080

45.63.5.129:443

128.199.192.135:8080

51.178.61.60:443

168.197.250.14:80

177.72.80.14:7080

51.210.242.234:8080

142.4.219.173:8080

78.47.204.80:443

78.46.73.125:443

37.44.244.177:8080

37.59.209.141:8080

104.131.62.48:8080

190.90.233.66:443

185.148.168.220:8080

185.148.168.15:8080

62.171.178.147:8080

191.252.103.16:80

54.38.242.185:443
eck1.plain
ecs1.plain

Targets

    • Target

      14bb08d9ec0d0c38ff6ab01fed57e9c5209039d2.xlsm

    • Size

      101KB

    • MD5

      357ab6e63b88762a709c7a4aa09f873b

    • SHA1

      14bb08d9ec0d0c38ff6ab01fed57e9c5209039d2

    • SHA256

      6ea0ad9cbb68fccd68b45f23ceb055ceb2decd4e17185bdc49e4e4ba213a2b3b

    • SHA512

      83bfa6fda00911f7ebf0ec0449db87f8e90cbdac840d55e93eaa66a1773ab11665519fae04272c939bfad320cdc99ac2cc998d60d1d46fb79506aa531a980191

    Score
    10/10
    emotetepoch5bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks