emotet

General

Target
Automobiles BGP.xls
Size 150KB
Sample220202-wtqx2aahg2
SHA256 03c8693d296d0623e27b0ce8d627da2ca935153353ac27bb23aa3a2ee7da8047
MD5 8dd9d2c0bd5f6b40d750205c48daa4ca
SHA1 2596a530b85c72f701cd53b7fb54d47cea21676d
SHA512 30a53aea103d3727191ef56eeb990a3554485ca14dc6704eff9235f32a657434754194619b55c55dcf0bf61da8efaaf835f46f1f33a8b201120da775ef39e684
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

Source

URLs

exe.dropper
http://actividades.laforetlanguages.com/wp-admin/BlkdOKDXL/
exe.dropper
http://sbcopylive.com.br/rjuz/w/
exe.dropper
https://trasix.com/wp-admin/y5Aa1jt0Sp2Qk/
exe.dropper
https://www.parkinsons.co.in/abc/Y6Y0fTbUEg6/
exe.dropper
https://biz.merlin.ua/wp-admin/W6agtFSRZGt371dV/
exe.dropper
http://bruckevn.site/3yztzzvh/nmY4wZfbYL/
exe.dropper
https://pardiskood.com/wp-content/NR/
exe.dropper
https://daujimaharajmandir.org/wp-includes/63De/
exe.dropper
https://datasits.com/wp-includes/Zkj4QO/
exe.dropper
https://anugerahmasinternasional.co.id/wp-admin/SJbxE5I/
exe.dropper
https://atmedic.cl/sistemas/3ZbsUAU/
exe.dropper
https://anwaralbasateen.com/Fox-C404/mDHkfgebMRzmGKBy/

Extracted

Family

emotet

Botnet

Epoch4

C2

23.246.204.126:443
149.56.163.161:8080
212.237.5.209:443
159.89.230.105:443
178.63.25.185:443
104.251.214.46:8080
195.154.133.20:443
217.182.143.207:443
103.75.201.4:443
162.243.175.63:443
173.212.193.249:8080
138.185.72.26:8080
107.182.225.142:8080
45.118.115.99:8080
46.55.222.11:443
212.237.56.116:7080
178.79.147.66:8080
160.16.102.168:80
212.237.17.99:8080
51.38.71.0:443
207.38.84.195:8080
212.24.98.99:8080
110.232.117.186:8080
159.8.59.82:8080
131.100.24.231:80
58.227.42.236:80
164.68.99.3:8080
103.75.201.2:443
41.76.108.46:8080
162.214.50.39:7080
50.116.54.215:443
203.114.109.124:443
45.142.114.231:8080
192.254.71.210:443
185.157.82.211:8080
45.118.135.203:7080
129.232.188.93:443
45.176.232.124:443
79.172.212.216:8080
158.69.222.101:443
144.76.186.49:8080
200.17.134.35:7080
176.104.106.96:8080
81.0.236.90:443
216.158.226.206:443

eck1.plain

ecs1.plain

Targets

- Target
  Automobiles BGP.xls
- Size 150KB
- SHA256 03c8693d296d0623e27b0ce8d627da2ca935153353ac27bb23aa3a2ee7da8047
- MD5 8dd9d2c0bd5f6b40d750205c48daa4ca
- SHA1 2596a530b85c72f701cd53b7fb54d47cea21676d
- SHA512 30a53aea103d3727191ef56eeb990a3554485ca14dc6704eff9235f32a657434754194619b55c55dcf0bf61da8efaaf835f46f1f33a8b201120da775ef39e684
- MD5 SHA1 SHA512
Score

10^/10

emotet epoch4 banker persistence trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request
- Downloads MZ/PE file
- Sets service image path in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Process spawned unexpected child process

Blocklisted process makes network request

Downloads MZ/PE file

Sets service image path in registry

Checks computer location settings

Loads dropped DLL

Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2