3d36b07ddede4d44f094c7c8bbf30b17f55c4ed4b0e3658dd8fabc89e70c8d94.xls

Target

Size

70KB

Sample

220521-vaa7ssacb4

Score

10 ^/10

MD5

9d5b0ea45b0d09c6fa10a4f5e0e875c9

SHA1

d9cbf6af6efb09854a5535a8578c9b3c24ef535a

SHA256

3d36b07ddede4d44f094c7c8bbf30b17f55c4ed4b0e3658dd8fabc89e70c8d94

SHA512

785eb1057d673be6b4d43edc8657af95ef3862a36fcac17cea9ed0bb86932be341bb64dd92e652ec884110fd0cde3515f4a8f646a4a8a25c26124a8dcafe3304

Extracted

Language	xlm4.0
Source
URLs	http://farschid.de/verkaufsberater_service/OZRw36a2y1CH2clUzY/ http://77homolog.com.br/dev-jealves/GP55wbYNXnp6/ http://geowf.ge/templates/pJRea3Iu3wG/ http://h63402x4.beget.tech/bin/wl0ENiE3BhELXV6V/ http://ecoarch.com.tw/cgi-bin/E/ https://galaxy-catering.com.vn/galxy/Fg1vvhlYJ/ xlm40.dropper http://farschid.de/verkaufsberater_service/OZRw36a2y1CH2clUzY/ xlm40.dropper http://77homolog.com.br/dev-jealves/GP55wbYNXnp6/ xlm40.dropper http://geowf.ge/templates/pJRea3Iu3wG/ xlm40.dropper http://h63402x4.beget.tech/bin/wl0ENiE3BhELXV6V/ xlm40.dropper http://ecoarch.com.tw/cgi-bin/E/ xlm40.dropper https://galaxy-catering.com.vn/galxy/Fg1vvhlYJ/

Extracted

Language	xlm4.0
Source
URLs	http://farschid.de/verkaufsberater_service/OZRw36a2y1CH2clUzY/ http://77homolog.com.br/dev-jealves/GP55wbYNXnp6/ http://geowf.ge/templates/pJRea3Iu3wG/ xlm40.dropper http://farschid.de/verkaufsberater_service/OZRw36a2y1CH2clUzY/ xlm40.dropper http://77homolog.com.br/dev-jealves/GP55wbYNXnp6/ xlm40.dropper http://geowf.ge/templates/pJRea3Iu3wG/

Extracted

Family	emotet
Botnet	Epoch4
C2	176.31.73.90:443 45.76.159.214:8080 138.197.147.101:443 104.168.154.79:8080 149.56.131.28:8080 5.9.116.246:8080 77.81.247.144:8080 172.104.251.154:8080 50.30.40.196:8080 173.212.193.249:8080 51.91.76.89:8080 197.242.150.244:8080 103.75.201.2:443 51.254.140.238:7080 79.137.35.198:8080 72.15.201.15:8080 27.54.89.58:8080 189.126.111.200:7080 196.218.30.83:443 82.165.152.127:8080 164.68.99.3:8080 183.111.227.137:8080 167.172.253.162:8080 153.126.146.25:7080 129.232.188.93:443 151.106.112.196:8080 188.44.20.25:443 167.99.115.35:8080 134.122.66.193:8080 185.4.135.165:8080 212.24.98.99:8080 51.91.7.5:8080 146.59.226.45:443 131.100.24.231:80 212.237.17.99:8080 201.94.166.162:443 45.176.232.124:443 159.65.88.10:8080 160.16.142.56:8080 216.158.226.206:443 203.114.109.124:443 103.43.46.182:443 46.55.222.11:443 209.126.98.206:8080 91.207.28.33:8080 1.234.2.232:8080 45.118.115.99:8080 206.189.28.199:8080 94.23.45.86:4143 158.69.222.101:443 103.70.28.102:8080 101.50.0.91:8080 58.227.42.236:80 119.193.124.41:7080 107.182.225.142:8080 185.157.82.211:8080 45.235.8.30:8080 103.132.242.26:8080 1.234.21.73:7080 110.232.117.186:8080 209.97.163.214:443 185.8.212.130:7080 209.250.246.206:443 176.31.73.90:443 45.76.159.214:8080 138.197.147.101:443 104.168.154.79:8080 149.56.131.28:8080 5.9.116.246:8080 77.81.247.144:8080 172.104.251.154:8080 50.30.40.196:8080 173.212.193.249:8080 51.91.76.89:8080 197.242.150.244:8080 103.75.201.2:443 51.254.140.238:7080 79.137.35.198:8080 72.15.201.15:8080 27.54.89.58:8080 189.126.111.200:7080 196.218.30.83:443 82.165.152.127:8080 164.68.99.3:8080 183.111.227.137:8080 167.172.253.162:8080 153.126.146.25:7080 129.232.188.93:443 151.106.112.196:8080 188.44.20.25:443 167.99.115.35:8080 134.122.66.193:8080 185.4.135.165:8080 212.24.98.99:8080 51.91.7.5:8080 146.59.226.45:443 131.100.24.231:80 212.237.17.99:8080 201.94.166.162:443 45.176.232.124:443 159.65.88.10:8080 160.16.142.56:8080 216.158.226.206:443 203.114.109.124:443 103.43.46.182:443 46.55.222.11:443 209.126.98.206:8080 91.207.28.33:8080 1.234.2.232:8080 45.118.115.99:8080 206.189.28.199:8080 94.23.45.86:4143 158.69.222.101:443 103.70.28.102:8080 101.50.0.91:8080 58.227.42.236:80 119.193.124.41:7080 107.182.225.142:8080 185.157.82.211:8080 45.235.8.30:8080 103.132.242.26:8080 1.234.21.73:7080 110.232.117.186:8080 209.97.163.214:443 185.8.212.130:7080 209.250.246.206:443
eck1.plain
ecs1.plain

Target

3d36b07ddede4d44f094c7c8bbf30b17f55c4ed4b0e3658dd8fabc89e70c8d94.xls

MD5

9d5b0ea45b0d09c6fa10a4f5e0e875c9

Filesize

70KB

Score

10^/10

SHA1

d9cbf6af6efb09854a5535a8578c9b3c24ef535a

SHA256

3d36b07ddede4d44f094c7c8bbf30b17f55c4ed4b0e3658dd8fabc89e70c8d94

SHA512

785eb1057d673be6b4d43edc8657af95ef3862a36fcac17cea9ed0bb86932be341bb64dd92e652ec884110fd0cde3515f4a8f646a4a8a25c26124a8dcafe3304

Signatures

Emotet
Description

Emotet is a trojan that is primarily spread through spam emails.
Tags

trojan banker emotet
Process spawned unexpected child process
Description

This typically indicates the parent process was compromised via an exploit or macro.
suricata: ET MALWARE W32/Emotet CnC Beacon 3
Description

suricata: ET MALWARE W32/Emotet CnC Beacon 3
Tags

suricata
Downloads MZ/PE file
Loads dropped DLL
Drops file in System32 directory

Related Tasks

behavioral1 behavioral2

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

static1

macro xlm

8^/10

behavioral1

10^/10

behavioral2

emotet epoch4 banker suricata trojan

10^/10

Extracted

Extracted

Extracted

Tags

Signatures

Emotet

Description

Tags

Process spawned unexpected child process

Description

suricata: ET MALWARE W32/Emotet CnC Beacon 3

Description

Tags

Downloads MZ/PE file

Loads dropped DLL

Drops file in System32 directory

Related Tasks

static1

behavioral1

behavioral2