Overview

overview

10

Static

static

8

BANK TRANS...CH.xls

windows7_x64

10

BANK TRANS...CH.xls

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    BANK TRANSFER COPY ACH.zip

  • Size

    38KB

  • Sample

    220630-q9x4dsbfcm

  • MD5

    b9149675fa3ff70dd61aca732bb24419

  • SHA1

    e3cf1af75f38070f8eb5a3a79097aac37709c495

  • SHA256

    e6e6ce18a4888eed3d079937b00cc71ccc8fddb764342b14e1e85b1e98304f95

  • SHA512

    043d0d6fe57be6fda5febd689f4918ec81b370fa745685d320cd8957646d706508e406f4be13241a496adbc4d9aa14285d510cb667742e8f36df3670362d942f

Score
10/10
emotetepoch4bankermacrosuricatatrojanxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://www.mobiles-photostudio.com/MPS/uYUKsZhII1qQ1/
xlm40.dropper

https://www.zablimconsultancy.co.ke/musagala/pmOVrwAwG/
xlm40.dropper

http://www.kspintidana.com/wp-admin/jjiOcQAL/
xlm40.dropper

http://www.garantihaliyikama.com/wp-admin/CcxWGjZEjriZ9zMdsP/

Extracted

Family

emotet

Botnet

Epoch4

C2

172.104.251.154:8080

51.161.73.194:443

101.50.0.91:8080

91.207.28.33:8080

119.193.124.41:7080

150.95.66.124:8080

103.132.242.26:8080

37.187.115.122:8080

172.105.226.75:8080

131.100.24.231:80

196.218.30.83:443

79.137.35.198:8080

103.75.201.2:443

82.223.21.224:8080

153.126.146.25:7080

146.59.226.45:443

209.97.163.214:443

186.194.240.217:443

197.242.150.244:8080

45.118.115.99:8080
eck1.plain
ecs1.plain

Extracted

Family

emotet

C2

104.236.40.81:443

34.80.191.247:8080

201.73.143.120:7080

165.227.166.238:8080

103.224.242.13:8080

131.100.24.199:4143

162.243.103.246:8080

203.114.109.124:443

104.248.155.133:443

51.79.205.117:8080

136.243.32.168:443

217.79.180.211:8080

34.85.105.209:8080

69.63.64.48:8080

51.91.142.26:443

45.93.136.110:7080

144.217.88.125:443

1.234.21.73:7080

159.8.59.84:8080

49.231.16.102:8080

Targets

    • Target

      BANK TRANSFER COPY ACH.xls

    • Size

      94KB

    • MD5

      bca774464f52e484a93f3841124758a1

    • SHA1

      1bf6b435f6389af53744e960dac2e643eaac4192

    • SHA256

      c45bf0bf43d9595be252f2646198e686ee50df78f2eafd8fd58f5fda324db8b5

    • SHA512

      21c3b41f831ff41d1a81d926c85fcdec6be37699d02665d8db2826a7c360646cc338a7e4ac30871420528ae1cf4819a911c38129ef7c70b3c83221763390c257

    Score
    10/10
    emotetepoch4bankersuricatatrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • suricata: ET MALWARE W32/Emotet CnC Beacon 3

      suricata: ET MALWARE W32/Emotet CnC Beacon 3

      suricata

    • Downloads MZ/PE file

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks