General
-
Target
786cdbbcab12d6076e895521a41dc5e5bd48fd09dbc85d4843a128c04dec73c2
-
Size
106KB
-
Sample
220330-xrmm9scbdp
-
MD5
5c945f91cb679e4982e1a05cc58971f0
-
SHA1
cc741cc3d41fec807b03d2ff508cac7e52adbfc7
-
SHA256
786cdbbcab12d6076e895521a41dc5e5bd48fd09dbc85d4843a128c04dec73c2
-
SHA512
0734a96479f61d568bdac2ae1e154986314ee2a00d5af4156f44056cd93382d381bc3937a4cb26c0c290bb311847988051e3d66e7079d3d34200fa870863ab74
Malware Config
Extracted
https://www.gessersh.com/wp-includes/ZwQLepW/
http://www.garantihaliyikama.com/wp-admin/FjgB6I/
https://www.fantasticmotion.jp/_cnskin/qfWEQrrwBg/
http://dmcontabilidade.com/correspondentecaixa/TrS/
https://fcelik.nl/rittenregistratie/web/css/B3ILfU8Xk2SsEmT/
http://fanfield.co.uk/cgi-bin/7pp6DjWFNJXY8/
Extracted
https://www.gessersh.com/wp-includes/ZwQLepW/
Extracted
emotet
Epoch4
104.131.11.205:443
138.197.109.175:8080
187.84.80.182:443
79.143.187.147:443
189.232.46.161:443
51.91.76.89:8080
103.43.46.182:443
206.189.28.199:8080
45.176.232.124:443
107.182.225.142:8080
72.15.201.15:8080
209.250.246.206:443
164.68.99.3:8080
160.16.142.56:8080
134.122.66.193:8080
45.118.115.99:8080
183.111.227.137:8080
209.126.98.206:8080
1.234.2.232:8080
159.65.88.10:8080
Targets
-
-
Target
786cdbbcab12d6076e895521a41dc5e5bd48fd09dbc85d4843a128c04dec73c2
-
Size
106KB
-
MD5
5c945f91cb679e4982e1a05cc58971f0
-
SHA1
cc741cc3d41fec807b03d2ff508cac7e52adbfc7
-
SHA256
786cdbbcab12d6076e895521a41dc5e5bd48fd09dbc85d4843a128c04dec73c2
-
SHA512
0734a96479f61d568bdac2ae1e154986314ee2a00d5af4156f44056cd93382d381bc3937a4cb26c0c290bb311847988051e3d66e7079d3d34200fa870863ab74
Score10/10-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Loads dropped DLL
-
Drops file in System32 directory
-