Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

UU3444499999999AA.lnk

windows7_x64

3

UU3444499999999AA.lnk

windows10-2004_x64

10

Resubmissions

06/09/2022, 13:38

220906-qxnn7adff7 10

14/06/2022, 07:29

220614-jbbdeacfdk 10

13/06/2022, 22:26

220613-2cyjfafdb8 10

13/06/2022, 20:59

220613-zstjbaagap 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    UU3444499999999AA.lnk

  • Size

    3KB

  • Sample

    220613-2cyjfafdb8

  • MD5

    08205fbc8d439bb4dbded1b3b4146daa

  • SHA1

    f07b89b0bb7691406f109e6be7d59551efa91fc7

  • SHA256

    3e3b827cf8b350d18fc92feb1c7bafd89ca2239eb903bef27bdc06a41de98b57

  • SHA512

    c1045c4ab9ce5e3fe0b2c13521b75e824b1501c626782aad55a20923d88ecdc9c0f28fd0b6f005dc5ea69b8af50bd7bb5963f389da55a4e7fc74fa8defbbc902

Score
10/10
emotetbankersuricatatrojan

Malware Config

Extracted

Family

emotet

C2

101.50.0.91:8080

159.89.202.34:443

209.97.163.214:443

173.212.193.249:8080

159.65.88.10:8080

45.118.115.99:8080

82.165.152.127:8080

207.148.79.14:8080

41.73.252.195:443

196.218.30.83:443

103.75.201.2:443

64.227.100.222:8080

149.56.131.28:8080

103.43.75.120:443

188.44.20.25:443

185.4.135.165:8080

91.207.28.33:8080

110.232.117.186:8080

72.15.201.15:8080

45.176.232.124:443
eck1.plain
ecs1.plain

Targets

    • Target

      UU3444499999999AA.lnk

    • Size

      3KB

    • MD5

      08205fbc8d439bb4dbded1b3b4146daa

    • SHA1

      f07b89b0bb7691406f109e6be7d59551efa91fc7

    • SHA256

      3e3b827cf8b350d18fc92feb1c7bafd89ca2239eb903bef27bdc06a41de98b57

    • SHA512

      c1045c4ab9ce5e3fe0b2c13521b75e824b1501c626782aad55a20923d88ecdc9c0f28fd0b6f005dc5ea69b8af50bd7bb5963f389da55a4e7fc74fa8defbbc902

    Score
    10/10
    emotetbankersuricatatrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • suricata: ET MALWARE W32/Emotet CnC Beacon 3

      suricata: ET MALWARE W32/Emotet CnC Beacon 3

      suricata

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks