emotet

General

Target

BANK TRANSFER COPY ACH.zip
Size

38KB
Sample

220630-q9x4dsbfcm
MD5

b9149675fa3ff70dd61aca732bb24419
SHA1

e3cf1af75f38070f8eb5a3a79097aac37709c495
SHA256

e6e6ce18a4888eed3d079937b00cc71ccc8fddb764342b14e1e85b1e98304f95
SHA512

043d0d6fe57be6fda5febd689f4918ec81b370fa745685d320cd8957646d706508e406f4be13241a496adbc4d9aa14285d510cb667742e8f36df3670362d942f

Score

10^/10

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://www.mobiles-photostudio.com/MPS/uYUKsZhII1qQ1/

xlm40.dropper

https://www.zablimconsultancy.co.ke/musagala/pmOVrwAwG/

xlm40.dropper

http://www.kspintidana.com/wp-admin/jjiOcQAL/

xlm40.dropper

http://www.garantihaliyikama.com/wp-admin/CcxWGjZEjriZ9zMdsP/

Extracted

Family

emotet

Botnet

Epoch4

C2

172.104.251.154:8080

51.161.73.194:443

101.50.0.91:8080

91.207.28.33:8080

119.193.124.41:7080

150.95.66.124:8080

103.132.242.26:8080

37.187.115.122:8080

172.105.226.75:8080

131.100.24.231:80

196.218.30.83:443

79.137.35.198:8080

103.75.201.2:443

82.223.21.224:8080

153.126.146.25:7080

146.59.226.45:443

209.97.163.214:443

186.194.240.217:443

197.242.150.244:8080

45.118.115.99:8080

eck1.plain

ecs1.plain

Extracted

Family

emotet

C2

104.236.40.81:443

34.80.191.247:8080

201.73.143.120:7080

165.227.166.238:8080

103.224.242.13:8080

131.100.24.199:4143

162.243.103.246:8080

203.114.109.124:443

104.248.155.133:443

51.79.205.117:8080

136.243.32.168:443

217.79.180.211:8080

34.85.105.209:8080

69.63.64.48:8080

51.91.142.26:443

45.93.136.110:7080

144.217.88.125:443

1.234.21.73:7080

159.8.59.84:8080

49.231.16.102:8080

Targets

- Target
  
  BANK TRANSFER COPY ACH.xls
- Size
  
  94KB
- MD5
  
  bca774464f52e484a93f3841124758a1
- SHA1
  
  1bf6b435f6389af53744e960dac2e643eaac4192
- SHA256
  
  c45bf0bf43d9595be252f2646198e686ee50df78f2eafd8fd58f5fda324db8b5
- SHA512
  
  21c3b41f831ff41d1a81d926c85fcdec6be37699d02665d8db2826a7c360646cc338a7e4ac30871420528ae1cf4819a911c38129ef7c70b3c83221763390c257
Score

10^/10

emotet epoch4 banker suricata trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- suricata: ET MALWARE W32/Emotet CnC Beacon 3
  suricata: ET MALWARE W32/Emotet CnC Beacon 3
  suricata
- Downloads MZ/PE file
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Targets

Process spawned unexpected child process

suricata: ET MALWARE W32/Emotet CnC Beacon 3

Downloads MZ/PE file

Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2