emotet

Sharing

Copy URL Twitter E-mail

General

Target
Fattura numero 93518 del 15.06.2022.xls
Size 80KB
Sample220615-p2zftaaba4
SHA256 6565c2959a8e637f2b0f8463eae7e6e453e830ce1761654aafc757c19e5f0fcb
MD5 b9dd7ece6cbb17424ec8c947cacb5b16
SHA1 6efeebf472ec5e94764eb70fcab8a098cdab87ed
SHA512 ec62b3c4c622a2ce87993c8cfba89d89cf335cfa4c28b2c733971a1314e9efba8178d4e7f054da5210e3460e7eb90ed5a4d69e6d6f872fe9b51375edec65a1b8
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper
http://byrdnest3.com/cgi-bin/TEq/
xlm40.dropper
http://carbonbros.co.za/logs/KSTJNdxZ73hIZPKddEDT/
xlm40.dropper
http://www.bubblefootballeurope.de/wp-admin/3aMMnYP/
xlm40.dropper
http://casov.com/proxy/kk0OWcstqPOOyeG/

Extracted

Family

emotet

101.50.0.91:8080
159.89.202.34:443
209.97.163.214:443
173.212.193.249:8080
159.65.88.10:8080
45.118.115.99:8080
82.165.152.127:8080
207.148.79.14:8080
41.73.252.195:443
196.218.30.83:443
103.75.201.2:443
64.227.100.222:8080
149.56.131.28:8080
103.43.75.120:443
188.44.20.25:443
185.4.135.165:8080
91.207.28.33:8080
110.232.117.186:8080
72.15.201.15:8080
45.176.232.124:443
46.55.222.11:443
163.44.196.120:8080
172.105.226.75:8080
5.9.116.246:8080
150.95.66.124:8080
94.23.45.86:4143
107.170.39.149:8080
209.126.98.206:8080
212.24.98.99:8080
167.172.253.162:8080
146.59.226.45:443
115.68.227.76:8080
164.68.99.3:8080
206.189.28.199:8080
186.194.240.217:443
158.69.222.101:443
172.104.251.154:8080
103.70.28.102:8080
45.186.16.18:443
51.254.140.238:7080
197.242.150.244:8080
51.161.73.194:443
201.94.166.162:443
160.16.142.56:8080
213.241.20.155:443
129.232.188.93:443
134.122.66.193:8080
45.235.8.30:8080
159.65.140.115:443
119.193.124.41:7080
151.106.112.196:8080
144.91.78.55:443
82.223.21.224:8080
183.111.227.137:8080
1.234.2.232:8080
153.126.146.25:7080
79.137.35.198:8080
103.132.242.26:8080
51.91.76.89:8080
37.187.115.122:8080
131.100.24.231:80
203.114.109.124:443
1.234.21.73:7080

eck1.plain

ecs1.plain

Targets

- Target
  Fattura numero 93518 del 15.06.2022.xls
- Size 80KB
- SHA256 6565c2959a8e637f2b0f8463eae7e6e453e830ce1761654aafc757c19e5f0fcb
- MD5 b9dd7ece6cbb17424ec8c947cacb5b16
- SHA1 6efeebf472ec5e94764eb70fcab8a098cdab87ed
- SHA512 ec62b3c4c622a2ce87993c8cfba89d89cf335cfa4c28b2c733971a1314e9efba8178d4e7f054da5210e3460e7eb90ed5a4d69e6d6f872fe9b51375edec65a1b8
- MD5 SHA1 SHA512
Score

10^/10

emotet banker suricata trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- suricata: ET MALWARE W32/Emotet CnC Beacon 3
  suricata: ET MALWARE W32/Emotet CnC Beacon 3
  suricata
- Downloads MZ/PE file
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Process spawned unexpected child process

suricata: ET MALWARE W32/Emotet CnC Beacon 3

Downloads MZ/PE file

Loads dropped DLL

Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2