Overview

overview

10

Static

static

8

W-9 form.xls

windows7_x64

10

W-9 form.xls

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    W-9 form copy 5.zip

  • Size

    38KB

  • Sample

    220630-rcd5padef7

  • MD5

    4516b6a4b45f983da1ac9609c3971f53

  • SHA1

    b04cfe73a930ac179f75e81f8e2f8390bcf9e97b

  • SHA256

    b9c6743b8e98fc7aae2d9bb9bb21d80fb917153c7eca95982896150969e94824

  • SHA512

    3e978070942430e1d2a0b47258c45c732d755d3854bbe46ac7a3b81959e279084d2937e5a0384bbc7520f6f75d10ced1bca3359549f3aa20ad33b7591dc5bdcd

Score
10/10
emotetepoch4bankermacrosuricatatrojanxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://www.fcstradesolutions.com/cgi-bin/EKrh/
xlm40.dropper

https://www.reneetten.nl/Menu/jKiBaSmhgyBD3/
xlm40.dropper

https://www.financialchile.com/art/nTXsGe8VHFLC5yH/
xlm40.dropper

https://www.periodistesgolf.cat/tmp/c71/

Extracted

Family

emotet

Botnet

Epoch4

C2

172.104.251.154:8080

51.161.73.194:443

101.50.0.91:8080

91.207.28.33:8080

119.193.124.41:7080

150.95.66.124:8080

103.132.242.26:8080

37.187.115.122:8080

172.105.226.75:8080

131.100.24.231:80

196.218.30.83:443

79.137.35.198:8080

103.75.201.2:443

82.223.21.224:8080

153.126.146.25:7080

146.59.226.45:443

209.97.163.214:443

186.194.240.217:443

197.242.150.244:8080

45.118.115.99:8080
eck1.plain
ecs1.plain

Extracted

Family

emotet

C2

104.236.40.81:443

34.80.191.247:8080

201.73.143.120:7080

165.227.166.238:8080

103.224.242.13:8080

131.100.24.199:4143

162.243.103.246:8080

203.114.109.124:443

104.248.155.133:443

51.79.205.117:8080

136.243.32.168:443

217.79.180.211:8080

34.85.105.209:8080

69.63.64.48:8080

51.91.142.26:443

45.93.136.110:7080

144.217.88.125:443

1.234.21.73:7080

159.8.59.84:8080

49.231.16.102:8080

Targets

    • Target

      W-9 form.xls

    • Size

      94KB

    • MD5

      45d272a4368eb90569243254c9261d2e

    • SHA1

      c078279a10fe4819f0579be8a2b590ff76c9d423

    • SHA256

      969acc76616662a5319380f3a3bf6dc82db768ce1173a54409cb65e0d403c94a

    • SHA512

      8abd54d77356e7fcccd897d1aa43ab5059ff317763a480eb417b19c738fed1a153b23e99430067073a4f5d258d5f5e032cbf15ee418b28917dfbfdf87fa7f14b

    Score
    10/10
    emotetepoch4bankersuricatatrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • suricata: ET MALWARE W32/Emotet CnC Beacon 3

      suricata: ET MALWARE W32/Emotet CnC Beacon 3

      suricata

    • Downloads MZ/PE file

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks