Malware sandboxing report by Hatching Triage

General

Target

0d75c0d596711a82fce15125c0e964cf57e3735f0e67540e6e274f45826a53d0.xls
Size

78KB
Sample

220521-wqcw1aaed3
MD5

42ec184c4712f82f4f1133be7127e053
SHA1

2059499dae78ef3a3919b23603053feb611800f2
SHA256

0d75c0d596711a82fce15125c0e964cf57e3735f0e67540e6e274f45826a53d0
SHA512

eacb85d8f94078dc6504fb9bd6f3913938b5658694fa004d6cf161ed8ce0f0861cffa39cbf5c365924c7f57822ab8112f476206c8b73a9127b9429af22e87733

Score

10^/10

Malware Config

Extracted

Language	xlm4.0
Source
URLs	https://hostal-alfonso12.com/clases/SKtPvv/ http://howesitgoing.com/images/HyaDnlbl6K7tbh2Lugys/ https://www.jdserralheria.com.br/cgi-bin/KFG6/ http://inteirado.com.br/fonts/7dJCVvuE5x3YrGQs2oJz/ http://iciee.untirta.ac.id/test/GccRw/ https://ideoso.com.tw/cgi-bin/zLrnBd2Eg1N3UVy5yL/ xlm40.dropper https://hostal-alfonso12.com/clases/SKtPvv/ xlm40.dropper http://howesitgoing.com/images/HyaDnlbl6K7tbh2Lugys/ xlm40.dropper https://www.jdserralheria.com.br/cgi-bin/KFG6/ xlm40.dropper http://inteirado.com.br/fonts/7dJCVvuE5x3YrGQs2oJz/ xlm40.dropper http://iciee.untirta.ac.id/test/GccRw/ xlm40.dropper https://ideoso.com.tw/cgi-bin/zLrnBd2Eg1N3UVy5yL/

Extracted

Language	xlm4.0
Source
URLs	https://hostal-alfonso12.com/clases/SKtPvv/ http://howesitgoing.com/images/HyaDnlbl6K7tbh2Lugys/ xlm40.dropper https://hostal-alfonso12.com/clases/SKtPvv/ xlm40.dropper http://howesitgoing.com/images/HyaDnlbl6K7tbh2Lugys/

Extracted

Family	emotet
Botnet	Epoch4
C2	131.100.24.231:80 103.132.242.26:8080 167.172.253.162:8080 149.56.131.28:8080 209.126.98.206:8080 188.44.20.25:443 212.237.17.99:8080 129.232.188.93:443 160.16.142.56:8080 46.55.222.11:443 1.234.2.232:8080 45.235.8.30:8080 185.157.82.211:8080 158.69.222.101:443 185.4.135.165:8080 27.54.89.58:8080 197.242.150.244:8080 153.126.146.25:7080 183.111.227.137:8080 103.75.201.2:443 45.118.115.99:8080 79.137.35.198:8080 172.104.251.154:8080 159.65.88.10:8080 203.114.109.124:443 101.50.0.91:8080 51.254.140.238:7080 206.189.28.199:8080 72.15.201.15:8080 150.95.66.124:8080 201.94.166.162:443 209.97.163.214:443 103.70.28.102:8080 185.8.212.130:7080 216.158.226.206:443 209.250.246.206:443 23.239.0.12:443 164.68.99.3:8080 102.222.215.74:443 134.122.66.193:8080 82.165.152.127:8080 51.91.76.89:8080 189.126.111.200:7080 146.59.226.45:443 163.44.196.120:8080 51.91.7.5:8080 58.227.42.236:80 167.99.115.35:8080 196.218.30.83:443 107.182.225.142:8080 151.106.112.196:8080 91.207.28.33:8080 94.23.45.86:4143 103.43.46.182:443 45.176.232.124:443 5.9.116.246:8080 173.212.193.249:8080 1.234.21.73:7080 212.24.98.99:8080 213.241.20.155:443 110.232.117.186:8080 77.81.247.144:8080 119.193.124.41:7080 131.100.24.231:80 103.132.242.26:8080 167.172.253.162:8080 149.56.131.28:8080 209.126.98.206:8080 188.44.20.25:443 212.237.17.99:8080 129.232.188.93:443 160.16.142.56:8080 46.55.222.11:443 1.234.2.232:8080 45.235.8.30:8080 185.157.82.211:8080 158.69.222.101:443 185.4.135.165:8080 27.54.89.58:8080 197.242.150.244:8080 153.126.146.25:7080 183.111.227.137:8080 103.75.201.2:443 45.118.115.99:8080 79.137.35.198:8080 172.104.251.154:8080 159.65.88.10:8080 203.114.109.124:443 101.50.0.91:8080 51.254.140.238:7080 206.189.28.199:8080 72.15.201.15:8080 150.95.66.124:8080 201.94.166.162:443 209.97.163.214:443 103.70.28.102:8080 185.8.212.130:7080 216.158.226.206:443 209.250.246.206:443 23.239.0.12:443 164.68.99.3:8080 102.222.215.74:443 134.122.66.193:8080 82.165.152.127:8080 51.91.76.89:8080 189.126.111.200:7080 146.59.226.45:443 163.44.196.120:8080 51.91.7.5:8080 58.227.42.236:80 167.99.115.35:8080 196.218.30.83:443 107.182.225.142:8080 151.106.112.196:8080 91.207.28.33:8080 94.23.45.86:4143 103.43.46.182:443 45.176.232.124:443 5.9.116.246:8080 173.212.193.249:8080 1.234.21.73:7080 212.24.98.99:8080 213.241.20.155:443 110.232.117.186:8080 77.81.247.144:8080 119.193.124.41:7080
eck1.plain
eck1.plain

Targets

- Target
  
  0d75c0d596711a82fce15125c0e964cf57e3735f0e67540e6e274f45826a53d0.xls
- Size
  
  78KB
- MD5
  
  42ec184c4712f82f4f1133be7127e053
- SHA1
  
  2059499dae78ef3a3919b23603053feb611800f2
- SHA256
  
  0d75c0d596711a82fce15125c0e964cf57e3735f0e67540e6e274f45826a53d0
- SHA512
  
  eacb85d8f94078dc6504fb9bd6f3913938b5658694fa004d6cf161ed8ce0f0861cffa39cbf5c365924c7f57822ab8112f476206c8b73a9127b9429af22e87733
Score

10^/10

emotet epoch4 banker suricata trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- suricata: ET MALWARE W32/Emotet CnC Beacon 3
  suricata: ET MALWARE W32/Emotet CnC Beacon 3
  suricata
- Downloads MZ/PE file
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Targets

Emotet

Process spawned unexpected child process

suricata: ET MALWARE W32/Emotet CnC Beacon 3

Downloads MZ/PE file

Loads dropped DLL

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2