Overview

overview

10

Static

static

8

emotet_v6

windows10_x64

10

emotet_doc

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c48a780e4664704fea5ddb053288a405a134644cd21cf1b2a21050df56d28d94

  • Size

    142KB

  • Sample

    220119-p5214shhfk

  • MD5

    8d6b43ca03cf1e4d675a523c4b06e214

  • SHA1

    6cdde32cd5ce069e00c952575714e66c55f091cc

  • SHA256

    c48a780e4664704fea5ddb053288a405a134644cd21cf1b2a21050df56d28d94

  • SHA512

    600dc0d8cd18517e49c8319c8a7e9feb8cdd6354d80ff1c0b7e99ccdbd9fc3651b30c07448792fd7b52ec877068d72a2c664c2e79ca8fcdfd542ff6f1c8f7418

Score
10/10
emotetepoch4bankermacrosuricatatrojanxlm

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://0xb907d607/fer/fer.html

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://185.7.214.7/fer/fer.png

Extracted

Family

emotet

Botnet

Epoch4

C2

131.100.24.231:80

209.59.138.75:7080

103.8.26.103:8080

51.38.71.0:443

212.237.17.99:8080

79.172.212.216:8080

207.38.84.195:8080

104.168.155.129:8080

178.79.147.66:8080

46.55.222.11:443

103.8.26.102:8080

192.254.71.210:443

45.176.232.124:443

203.114.109.124:443

51.68.175.8:8080

58.227.42.236:80

45.142.114.231:8080

217.182.143.207:443

178.63.25.185:443

45.118.115.99:8080
eck1.plain
ecs1.plain

Targets

    • Target

      c48a780e4664704fea5ddb053288a405a134644cd21cf1b2a21050df56d28d94

    • Size

      142KB

    • MD5

      8d6b43ca03cf1e4d675a523c4b06e214

    • SHA1

      6cdde32cd5ce069e00c952575714e66c55f091cc

    • SHA256

      c48a780e4664704fea5ddb053288a405a134644cd21cf1b2a21050df56d28d94

    • SHA512

      600dc0d8cd18517e49c8319c8a7e9feb8cdd6354d80ff1c0b7e99ccdbd9fc3651b30c07448792fd7b52ec877068d72a2c664c2e79ca8fcdfd542ff6f1c8f7418

    Score
    10/10
    emotetepoch4bankersuricatatrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • suricata: ET MALWARE W32/Emotet CnC Beacon 3

      suricata: ET MALWARE W32/Emotet CnC Beacon 3

      suricata

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks