emotet

General

Target
2022-02-03-950406441eee28ee3cff015f2e3b8c9f_unzipped.bin
Size 104KB
Sample220203-mpd81afgdp
SHA256 2bf48c20b48e4ca007993f9dd3cd141883f8b52252be3dd9e2d3a2531dd504a1
MD5 950406441eee28ee3cff015f2e3b8c9f
SHA1 ef3fc327e4b3cc51894f0050a1de95710f5a572f
SHA512 68d69b08ad49aa0cac1c5661dffebcd5d2e541d7d13f84534b9f2823f9d9692753565b798ae07874da502706c7c1d17e2833456715decf72881ed5831d13a18d
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper
http://cableequipmentmanagementreturns.com/wp-admin/JPivizxmiwo9A5Owys/
xlm40.dropper
http://novawedevent.com/tmp/PA0rBwFszIpy/
xlm40.dropper
https://www.altasolutions.asia/myfiles/myB984EnOlSJJ4b9/

Extracted

Family

emotet

Botnet

Epoch5

C2

172.105.115.71:443
185.184.25.78:8080
191.252.103.16:80
207.148.81.119:8080
37.44.244.177:8080
210.57.209.142:8080
37.59.209.141:8080
59.148.253.194:443
159.69.237.188:443
195.154.146.35:443
203.153.216.46:443
104.131.62.48:8080
173.203.78.138:443
217.182.143.207:443
54.38.242.185:443
116.124.128.206:8080
54.37.106.167:8080
195.77.239.39:8080
85.214.67.203:8080
198.199.98.78:8080
190.90.233.66:443
103.41.204.169:8080
185.148.168.15:8080
185.148.168.220:8080
142.4.219.173:8080
168.197.250.14:80
139.196.72.155:8080
118.98.72.86:443
128.199.192.135:8080
78.46.73.125:443
66.42.57.149:443
78.47.204.80:443
194.9.172.107:8080
62.171.178.147:8080
54.37.228.122:443

eck1.plain

ecs1.plain

Targets

- Target
  2022-02-03-950406441eee28ee3cff015f2e3b8c9f_unzipped.bin
- Size 104KB
- SHA256 2bf48c20b48e4ca007993f9dd3cd141883f8b52252be3dd9e2d3a2531dd504a1
- MD5 950406441eee28ee3cff015f2e3b8c9f
- SHA1 ef3fc327e4b3cc51894f0050a1de95710f5a572f
- SHA512 68d69b08ad49aa0cac1c5661dffebcd5d2e541d7d13f84534b9f2823f9d9692753565b798ae07874da502706c7c1d17e2833456715decf72881ed5831d13a18d
- MD5 SHA1 SHA512
Score

10^/10

emotet epoch5 banker suricata trojan persistence
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- suricata: ET MALWARE W32/Emotet CnC Beacon 3
  suricata: ET MALWARE W32/Emotet CnC Beacon 3
  suricata
- Blocklisted process makes network request
- Downloads MZ/PE file
- Sets service image path in registry
  persistence
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Process spawned unexpected child process

suricata: ET MALWARE W32/Emotet CnC Beacon 3

Blocklisted process makes network request

Downloads MZ/PE file

Sets service image path in registry

Loads dropped DLL

Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2