Malware sandboxing report by Hatching Triage

Target

a143d87f0842c73830ec5045ed73c4b0c50a8f1ded1d987b53e2d2c6c768aee6.xls

Size

95KB

Sample

220707-etg7fsfah5

Score

10^/10

MD5

9188649c1cdfb1cd39d80b9980753675

SHA1

42a9d1e4dcb5b57c944b41874f30f9a38a6c24d4

SHA256

a143d87f0842c73830ec5045ed73c4b0c50a8f1ded1d987b53e2d2c6c768aee6

SHA512

812c486a73c8db8614f55e31ed5ad03f08baf336e42639646612bcad6c15b9c4360a51ee8300b7cb0a1c471caed5f06eb9845e60a73498501c7453375ab71f93

Extracted

Language	xlm4.0
Source
URLs	http://www.sunflowerlaboratory.in/fonts/79Tq62ly/ http://dirigent.co.uk/vardagsekonomi/iC36jJ4J1cf/ http://agtrade.hu/images/kiQYmOs2tSKq/ https://www.zachboyle.com/wp-admin/EA470ZrTGNkuA/ xlm40.dropper http://www.sunflowerlaboratory.in/fonts/79Tq62ly/ xlm40.dropper http://dirigent.co.uk/vardagsekonomi/iC36jJ4J1cf/ xlm40.dropper http://agtrade.hu/images/kiQYmOs2tSKq/ xlm40.dropper https://www.zachboyle.com/wp-admin/EA470ZrTGNkuA/

Extracted

Family	emotet
Botnet	Epoch4
C2	94.23.45.86:4143 209.97.163.214:443 212.24.98.99:8080 103.43.75.120:443 183.111.227.137:8080 197.242.150.244:8080 129.232.188.93:443 159.65.88.10:8080 163.44.196.120:8080 51.161.73.194:443 164.90.222.65:443 159.89.202.34:443 1.234.2.232:8080 150.95.66.124:8080 51.91.76.89:8080 196.218.30.83:443 5.9.116.246:8080 146.59.226.45:443 173.212.193.249:8080 213.241.20.155:443 213.239.212.5:443 207.148.79.14:8080 51.254.140.238:7080 45.235.8.30:8080 147.139.166.154:8080 64.227.100.222:8080 82.165.152.127:8080 172.105.226.75:8080 131.100.24.231:80 206.189.28.199:8080 151.106.112.196:8080 119.193.124.41:7080 45.176.232.124:443 79.137.35.198:8080 186.194.240.217:443 103.70.28.102:8080 159.65.140.115:443 104.168.155.143:8080 45.118.115.99:8080 115.68.227.76:8080 72.15.201.15:8080 144.202.108.116:8080 37.187.115.122:8080 110.232.117.186:8080 209.126.98.206:8080 172.104.251.154:8080 82.223.21.224:8080 101.50.0.91:8080 103.132.242.26:8080 201.94.166.162:443 185.4.135.165:8080 160.16.142.56:8080 107.170.39.149:8080 134.122.66.193:8080 139.59.126.41:443 149.56.131.28:8080 91.207.28.33:8080 164.68.99.3:8080 188.44.20.25:443 103.75.201.2:443 167.172.253.162:8080 158.69.222.101:443 153.126.146.25:7080 94.23.45.86:4143 209.97.163.214:443 212.24.98.99:8080 103.43.75.120:443 183.111.227.137:8080 197.242.150.244:8080 129.232.188.93:443 159.65.88.10:8080 163.44.196.120:8080 51.161.73.194:443 164.90.222.65:443 159.89.202.34:443 1.234.2.232:8080 150.95.66.124:8080 51.91.76.89:8080 196.218.30.83:443 5.9.116.246:8080 146.59.226.45:443 173.212.193.249:8080 213.241.20.155:443 213.239.212.5:443 207.148.79.14:8080 51.254.140.238:7080 45.235.8.30:8080 147.139.166.154:8080 64.227.100.222:8080 82.165.152.127:8080 172.105.226.75:8080 131.100.24.231:80 206.189.28.199:8080 151.106.112.196:8080 119.193.124.41:7080 45.176.232.124:443 79.137.35.198:8080 186.194.240.217:443 103.70.28.102:8080 159.65.140.115:443 104.168.155.143:8080 45.118.115.99:8080 115.68.227.76:8080 72.15.201.15:8080 144.202.108.116:8080 37.187.115.122:8080 110.232.117.186:8080 209.126.98.206:8080 172.104.251.154:8080 82.223.21.224:8080 101.50.0.91:8080 103.132.242.26:8080 201.94.166.162:443 185.4.135.165:8080 160.16.142.56:8080 107.170.39.149:8080 134.122.66.193:8080 139.59.126.41:443 149.56.131.28:8080 91.207.28.33:8080 164.68.99.3:8080 188.44.20.25:443 103.75.201.2:443 167.172.253.162:8080 158.69.222.101:443 153.126.146.25:7080
eck1.plain
ecs1.plain

Target

a143d87f0842c73830ec5045ed73c4b0c50a8f1ded1d987b53e2d2c6c768aee6.xls

MD5

9188649c1cdfb1cd39d80b9980753675

Filesize

95KB

Score

10^/10

SHA1

42a9d1e4dcb5b57c944b41874f30f9a38a6c24d4

SHA256

a143d87f0842c73830ec5045ed73c4b0c50a8f1ded1d987b53e2d2c6c768aee6

SHA512

812c486a73c8db8614f55e31ed5ad03f08baf336e42639646612bcad6c15b9c4360a51ee8300b7cb0a1c471caed5f06eb9845e60a73498501c7453375ab71f93

Signatures

Emotet
Description

Emotet is a trojan that is primarily spread through spam emails.
Tags

trojan banker emotet
Process spawned unexpected child process
Description

This typically indicates the parent process was compromised via an exploit or macro.
suricata: ET MALWARE W32/Emotet CnC Beacon 3
Description

suricata: ET MALWARE W32/Emotet CnC Beacon 3
Tags

suricata
Downloads MZ/PE file
Loads dropped DLL

Related Tasks

behavioral1 behavioral2

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

static1

macro xlm

Score

8^/10

behavioral1

Score

10^/10

behavioral2

emotet epoch4 banker suricata trojan

Score

10^/10

Extracted

Extracted

Tags

Signatures

Emotet

Description

Tags

Process spawned unexpected child process

Description

suricata: ET MALWARE W32/Emotet CnC Beacon 3

Description

Tags

Downloads MZ/PE file

Loads dropped DLL

Related Tasks

static1

behavioral1

behavioral2