General
-
Target
629e7456ae38c8b30d5334a2b33b9be6015c9b610acc087684481707a894fff3
-
Size
106KB
-
Sample
220329-2cnn8sgccr
-
MD5
373ccbe50ee2281658593842cd86e248
-
SHA1
d915e3ad200aabf551e8a1a445886d928be7f64b
-
SHA256
629e7456ae38c8b30d5334a2b33b9be6015c9b610acc087684481707a894fff3
-
SHA512
9018e3c1273dac6fabd60f2996f3f8d347d3d298df11ebf672e16097d17443fb1ce49948fea1cf991392f0ea9afc67e6c458f0ebe89b0cbc6ada27cf754c6161
Malware Config
Extracted
http://dougveeder.com/cgi-bin/xJ91ZttGRioQ7IUL/
https://e-fistik.com/ajax/PnA23/
http://dsinformaticos.com/_private/f36Yl/
http://dstny.net/cgi-bin/POqJKcxiIzRb/
http://fakecity.net/cache/XtIzhyLEoLI7/
http://fayeschmidt.com/cgi-bin/Q8pj6/
Extracted
http://dougveeder.com/cgi-bin/xJ91ZttGRioQ7IUL/
https://e-fistik.com/ajax/PnA23/
Extracted
emotet
Epoch4
45.176.232.125:443
138.197.109.175:8080
187.84.80.182:443
79.143.187.147:443
189.232.46.161:443
103.70.28.102:8080
134.122.66.193:8080
151.106.112.196:8080
160.16.142.56:8080
212.24.98.99:8080
188.44.20.25:443
197.242.150.244:8080
206.189.28.199:8080
172.104.251.154:8080
103.43.46.182:443
203.114.109.124:443
103.75.201.2:443
58.227.42.236:80
201.94.166.162:443
189.126.111.200:7080
Targets
-
-
Target
629e7456ae38c8b30d5334a2b33b9be6015c9b610acc087684481707a894fff3
-
Size
106KB
-
MD5
373ccbe50ee2281658593842cd86e248
-
SHA1
d915e3ad200aabf551e8a1a445886d928be7f64b
-
SHA256
629e7456ae38c8b30d5334a2b33b9be6015c9b610acc087684481707a894fff3
-
SHA512
9018e3c1273dac6fabd60f2996f3f8d347d3d298df11ebf672e16097d17443fb1ce49948fea1cf991392f0ea9afc67e6c458f0ebe89b0cbc6ada27cf754c6161
Score10/10-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Drops file in System32 directory
-