Overview

overview

10

Static

static

8

NOTICE_74572.xls

windows7_x64

10

NOTICE_74572.xls

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NOTICE_74572.xls

  • Size

    73KB

  • Sample

    220517-g92l5sgac3

  • MD5

    c64292e4b093228141d3531fc50d3faf

  • SHA1

    eacc3c8c7cbdc3ec385615c7485ada4c5cc09af4

  • SHA256

    db606ab69b263ca51c4b5148f7bd8388278a4954234bd1dbe70bfb358e77420a

  • SHA512

    c50c3c29125051d481d723ab7a7eb6dd717ae9e3694dbf09b65b43a974895e17d682331d8b00b9b340f7bc2b0f0b7795af2c83c90a6c6e4c321722ebfece86b7

Score
10/10
emotetepoch5bankermacrotrojanxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://ilriparatutto.eu/tmp/0K1NupyKPeX/

Extracted

Family

emotet

Botnet

Epoch5

C2

93.104.209.107:8080

195.154.146.35:443

202.134.4.210:7080

17.20.148.183:8907

185.148.168.220:8080

68.183.93.250:443

175.126.176.79:8080

77.31.27.120:26351

203.153.216.46:443

202.28.34.99:8080

210.57.209.142:8080

18.229.236.50:18850

36.67.23.59:443

159.69.237.188:443

107.22.159.198:7774

207.148.81.119:8080

54.38.143.246:7080

45.71.195.104:8080

108.159.107.249:48268

45.230.140.156:22366
eck1.plain
eck1.plain

Targets

    • Target

      NOTICE_74572.xls

    • Size

      73KB

    • MD5

      c64292e4b093228141d3531fc50d3faf

    • SHA1

      eacc3c8c7cbdc3ec385615c7485ada4c5cc09af4

    • SHA256

      db606ab69b263ca51c4b5148f7bd8388278a4954234bd1dbe70bfb358e77420a

    • SHA512

      c50c3c29125051d481d723ab7a7eb6dd717ae9e3694dbf09b65b43a974895e17d682331d8b00b9b340f7bc2b0f0b7795af2c83c90a6c6e4c321722ebfece86b7

    Score
    10/10
    emotetepoch5bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Downloads MZ/PE file

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks