Resubmissions

19-04-2022 06:55

220419-hp816aded9 7

19-04-2022 06:28

220419-g8bdkahaep 10

18-04-2022 14:00

220418-razzdaadgr 10

General

  • Target

    e4-5375ff373df38f4dde8f1b1dbcb3b31b.dll

  • Size

    418KB

  • Sample

    220418-razzdaadgr

  • MD5

    5375ff373df38f4dde8f1b1dbcb3b31b

  • SHA1

    8ce588d597c71834e5c7dc15ab1edfeca579e4ea

  • SHA256

    a7382facbd03fb12d421629ce240b1e119f7ee6dfbdd16a96a9f86d3fce906cd

  • SHA512

    886092d33dec60ce51a6139abd6a8e6eba01b43715c64b50788e936e1e58a9adf7eeaf4a71aaf3e176ca0a4797ba26b6fd9f55af7c4d4a94da1a82fb6e885f51

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

138.197.147.101:443

134.195.212.50:7080

104.168.154.79:8080

149.56.131.28:8080

187.84.80.182:443

158.69.222.101:443

91.207.28.33:8080

5.9.116.246:8080

103.70.28.102:8080

153.126.146.25:7080

189.126.111.200:7080

110.232.117.186:8080

167.99.115.35:8080

146.59.226.45:443

201.94.166.162:443

103.43.46.182:443

103.132.242.26:8080

185.4.135.165:8080

159.65.88.10:8080

1.234.21.73:7080

eck1.plain
ecs1.plain

Targets

    • Target

      e4-5375ff373df38f4dde8f1b1dbcb3b31b.dll

    • Size

      418KB

    • MD5

      5375ff373df38f4dde8f1b1dbcb3b31b

    • SHA1

      8ce588d597c71834e5c7dc15ab1edfeca579e4ea

    • SHA256

      a7382facbd03fb12d421629ce240b1e119f7ee6dfbdd16a96a9f86d3fce906cd

    • SHA512

      886092d33dec60ce51a6139abd6a8e6eba01b43715c64b50788e936e1e58a9adf7eeaf4a71aaf3e176ca0a4797ba26b6fd9f55af7c4d4a94da1a82fb6e885f51

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • suricata: ET MALWARE W32/Emotet CnC Beacon 3

      suricata: ET MALWARE W32/Emotet CnC Beacon 3

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Matrix

Tasks