emotet | 04c40a669fcfcd20bd429cbe4f78c71e8403ca70f804262a24024cb40dba321b

General

Target

28BEE1E0000.exe
Size

180KB
Sample

221115-hke8aafc83
MD5

b197b4b9d825a927bac9f3d215b5e3f0
SHA1

099e7d6c295905678771402195088bbf087175a9
SHA256

04c40a669fcfcd20bd429cbe4f78c71e8403ca70f804262a24024cb40dba321b
SHA512

31f7c5fed94f341c55d1326c7df5a0441ea93ca6ba3b4820f0a4f04cc3cbe7380df0e04a1932a42a7c5c7074ef0ef61ec98e687c000826218ae0932d99bf404a
SSDEEP

3072:OCS65TUo7WInfB2A5MNJgEqVw7UPej+1Ae7swyo8sTYBA:bJ5TUoznfUbgEqCI1lcsTYy

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

45.235.8.30:8080

94.23.45.86:4143

119.59.103.152:8080

169.60.181.70:8080

164.68.99.3:8080

172.105.226.75:8080

107.170.39.149:8080

206.189.28.199:8080

1.234.2.232:8080

188.44.20.25:443

186.194.240.217:443

103.43.75.120:443

149.28.143.92:443

159.89.202.34:443

209.97.163.214:443

183.111.227.137:8080

129.232.188.93:443

139.59.126.41:443

110.232.117.186:8080

139.59.56.73:8080

eck1.plain

ecs1.plain

Targets

- Target
  
  28BEE1E0000.exe
- Size
  
  180KB
- MD5
  
  b197b4b9d825a927bac9f3d215b5e3f0
- SHA1
  
  099e7d6c295905678771402195088bbf087175a9
- SHA256
  
  04c40a669fcfcd20bd429cbe4f78c71e8403ca70f804262a24024cb40dba321b
- SHA512
  
  31f7c5fed94f341c55d1326c7df5a0441ea93ca6ba3b4820f0a4f04cc3cbe7380df0e04a1932a42a7c5c7074ef0ef61ec98e687c000826218ae0932d99bf404a
- SSDEEP
  
  3072:OCS65TUo7WInfB2A5MNJgEqVw7UPej+1Ae7swyo8sTYBA:bJ5TUoznfUbgEqCI1lcsTYy
Score

6^/10

persistence
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2