General

  • Target

    a2e8e46ba6387fd9ed8bb48ca8af38613829d48d2597d18b0e8a9dc104cf29d0

  • Size

    219KB

  • Sample

    220317-wm4wbadfc4

  • MD5

    9b39659a40f2adc3a18d8ff3a617a2d6

  • SHA1

    dbad43acf7a2e258278b65b18b792dfeeb353853

  • SHA256

    a2e8e46ba6387fd9ed8bb48ca8af38613829d48d2597d18b0e8a9dc104cf29d0

  • SHA512

    b567e6a6aa6d872c27f6fe4480cc8c3e6202b20473418ddc04877e762c32162ce1f81e9f9f85d6a216e9dcd22fa9365adeeb3a459b24bbd920d2ea5d0b1eb067

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

173.70.61.180:80

59.21.235.119:80

50.116.111.59:8080

173.249.20.233:443

188.165.214.98:8080

72.188.173.74:80

74.40.205.197:443

64.207.182.168:8080

97.120.3.198:80

190.29.166.0:80

123.176.25.234:80

155.186.9.160:80

138.68.87.218:443

139.99.158.11:443

78.24.219.147:8080

58.1.242.115:80

108.21.72.56:443

188.219.31.12:80

70.180.33.202:80

181.171.209.241:443

rsa_pubkey.plain

Targets

    • Target

      a2e8e46ba6387fd9ed8bb48ca8af38613829d48d2597d18b0e8a9dc104cf29d0

    • Size

      219KB

    • MD5

      9b39659a40f2adc3a18d8ff3a617a2d6

    • SHA1

      dbad43acf7a2e258278b65b18b792dfeeb353853

    • SHA256

      a2e8e46ba6387fd9ed8bb48ca8af38613829d48d2597d18b0e8a9dc104cf29d0

    • SHA512

      b567e6a6aa6d872c27f6fe4480cc8c3e6202b20473418ddc04877e762c32162ce1f81e9f9f85d6a216e9dcd22fa9365adeeb3a459b24bbd920d2ea5d0b1eb067

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet3

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks