General
-
Target
Report.xlsm
-
Size
69KB
-
Sample
220226-lyxk9sach5
-
MD5
19d026b39be0497f32b2b81a4da9f2f2
-
SHA1
a5da94930f5049fd16617ef1b25095cd56015b2a
-
SHA256
d9420b36f3f63a67c68f30b55881c0128cf680306e228a22ba7b6fd3d4a3ad7e
-
SHA512
c24e931337fe91be874990f82e6f1e91727edb516e0f3717fc52eeca14c4bc34ed035845ff21890f7ccf6c2a2dfc9e56eda0af787fe02f130dd8281a47de3ce2
Behavioral task
behavioral1
Sample
Report.xlsm
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
Report.xlsm
Resource
win10v2004-en-20220112
Malware Config
Extracted
https://vasilestudio.com/wp-admin/pZ1vbd5Z/
Extracted
emotet
Epoch4
169.197.131.16:8080
195.154.253.60:8080
152.89.239.34:443
216.158.226.206:443
159.65.88.10:8080
209.126.98.206:8080
158.69.222.101:443
173.212.193.249:8080
185.157.82.211:8080
81.0.236.90:443
103.75.201.2:443
46.55.222.11:443
159.8.59.82:8080
207.38.84.195:8080
50.116.54.215:443
79.172.212.216:8080
212.237.17.99:8080
212.24.98.99:8080
178.79.147.66:8080
51.254.140.238:7080
107.182.225.142:8080
1.234.2.232:8080
153.126.203.229:8080
129.232.188.93:443
164.68.99.3:8080
178.128.83.165:80
212.237.56.116:7080
45.176.232.124:443
162.243.175.63:443
175.107.196.192:80
131.100.24.231:80
82.165.152.127:8080
45.142.114.231:8080
138.185.72.26:8080
103.134.85.85:80
103.75.201.4:443
110.232.117.186:8080
31.24.158.56:8080
119.235.255.201:8080
45.118.135.203:7080
217.182.143.207:443
195.154.133.20:443
58.227.42.236:80
203.114.109.124:443
45.118.115.99:8080
176.104.106.96:8080
50.30.40.196:8080
Targets
-
-
Target
Report.xlsm
-
Size
69KB
-
MD5
19d026b39be0497f32b2b81a4da9f2f2
-
SHA1
a5da94930f5049fd16617ef1b25095cd56015b2a
-
SHA256
d9420b36f3f63a67c68f30b55881c0128cf680306e228a22ba7b6fd3d4a3ad7e
-
SHA512
c24e931337fe91be874990f82e6f1e91727edb516e0f3717fc52eeca14c4bc34ed035845ff21890f7ccf6c2a2dfc9e56eda0af787fe02f130dd8281a47de3ce2
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Drops file in System32 directory
-