emotet

Sharing

Copy URL Twitter E-mail

General

Target
Qq_20220614_667676_001.xls
Size 60KB
Sample220614-mvh45shee2
SHA256 3d03b6bcf37ea2c90b47f3860fa5e5d2f1d2f714902c7badc4b1cff91ba440eb
MD5 69f882520fc45bbc0013c494a02209ac
SHA1 acfef800ddf33176309caa98145b0634ff8b95ae
SHA512 ff35db5923940a2450a8fd293578a196cdda85b0c15829a8c558f50fbd6bb6aa765a95e0ce7bf5694a17049d2d2f4e1073cce16c0e9d61d1598896d1a56f3cbd
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper
http1
xlm40.dropper
https://agitasi.id/m/qLCZWt/
xlm40.dropper
http://djhost.nl/8HOicoBufQNbjbM/
xlm40.dropper
https://computercollegiate.com.pk/wp-admin/q69DZX4kKZ6ssRQ/

Extracted

Family

emotet

101.50.0.91:8080
159.89.202.34:443
209.97.163.214:443
173.212.193.249:8080
159.65.88.10:8080
45.118.115.99:8080
82.165.152.127:8080
207.148.79.14:8080
41.73.252.195:443
196.218.30.83:443
103.75.201.2:443
64.227.100.222:8080
149.56.131.28:8080
103.43.75.120:443
188.44.20.25:443
185.4.135.165:8080
91.207.28.33:8080
110.232.117.186:8080
72.15.201.15:8080
45.176.232.124:443
46.55.222.11:443
163.44.196.120:8080
172.105.226.75:8080
5.9.116.246:8080
150.95.66.124:8080
94.23.45.86:4143
107.170.39.149:8080
209.126.98.206:8080
212.24.98.99:8080
167.172.253.162:8080
146.59.226.45:443
115.68.227.76:8080
164.68.99.3:8080
206.189.28.199:8080
186.194.240.217:443
158.69.222.101:443
172.104.251.154:8080
103.70.28.102:8080
45.186.16.18:443
51.254.140.238:7080
197.242.150.244:8080
51.161.73.194:443
201.94.166.162:443
160.16.142.56:8080
213.241.20.155:443
129.232.188.93:443
134.122.66.193:8080
45.235.8.30:8080
159.65.140.115:443
119.193.124.41:7080
151.106.112.196:8080
144.91.78.55:443
82.223.21.224:8080
183.111.227.137:8080
1.234.2.232:8080
153.126.146.25:7080
79.137.35.198:8080
103.132.242.26:8080
51.91.76.89:8080
37.187.115.122:8080
131.100.24.231:80
203.114.109.124:443
1.234.21.73:7080

eck1.plain

ecs1.plain

Targets

- Target
  Qq_20220614_667676_001.xls
- Size 60KB
- SHA256 3d03b6bcf37ea2c90b47f3860fa5e5d2f1d2f714902c7badc4b1cff91ba440eb
- MD5 69f882520fc45bbc0013c494a02209ac
- SHA1 acfef800ddf33176309caa98145b0634ff8b95ae
- SHA512 ff35db5923940a2450a8fd293578a196cdda85b0c15829a8c558f50fbd6bb6aa765a95e0ce7bf5694a17049d2d2f4e1073cce16c0e9d61d1598896d1a56f3cbd
- MD5 SHA1 SHA512
Score

10^/10

emotet banker trojan suricata
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- suricata: ET MALWARE W32/Emotet CnC Beacon 3
  suricata: ET MALWARE W32/Emotet CnC Beacon 3
  suricata
- Downloads MZ/PE file
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Process spawned unexpected child process

suricata: ET MALWARE W32/Emotet CnC Beacon 3

Downloads MZ/PE file

Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2