General

  • Target

    e4-6a44ec160d5e90512d4306d94d182d2d.dll

  • Size

    437KB

  • Sample

    221115-x2bczsfd75

  • MD5

    6a44ec160d5e90512d4306d94d182d2d

  • SHA1

    9dc11c3e822792af161bdf8b44c2d9ebb1c95e63

  • SHA256

    79e3f37bb1026a5c1205c86621af6ada029428f206ae45b03f91da22351b4737

  • SHA512

    e15b69ddea315300a61fc6aa42137d5130ec408b76f4237548a7ca8ee95ebea84ed95af770b273384f50454c63da1687da02b46bdbde610de130ed72a9274cb7

  • SSDEEP

    6144:Ypbe+TznjXD0s8gan6r+DgQl8QGkdh5q0xowArB25IwGEytJB8tF/:YpbYvA+8QlZpb5H+wArMIsytUt

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

185.4.135.165:8080

159.89.202.34:443

82.223.21.224:8080

187.63.160.88:80

188.44.20.25:443

91.187.140.35:8080

110.232.117.186:8080

197.242.150.244:8080

119.59.103.152:8080

182.162.143.56:443

72.15.201.15:8080

173.255.211.88:443

206.189.28.199:8080

94.23.45.86:4143

45.63.99.23:7080

153.126.146.25:7080

45.118.115.99:8080

115.68.227.76:8080

163.44.196.120:8080

159.65.140.115:443

ecs1.plain
eck1.plain

Targets

    • Target

      e4-6a44ec160d5e90512d4306d94d182d2d.dll

    • Size

      437KB

    • MD5

      6a44ec160d5e90512d4306d94d182d2d

    • SHA1

      9dc11c3e822792af161bdf8b44c2d9ebb1c95e63

    • SHA256

      79e3f37bb1026a5c1205c86621af6ada029428f206ae45b03f91da22351b4737

    • SHA512

      e15b69ddea315300a61fc6aa42137d5130ec408b76f4237548a7ca8ee95ebea84ed95af770b273384f50454c63da1687da02b46bdbde610de130ed72a9274cb7

    • SSDEEP

      6144:Ypbe+TznjXD0s8gan6r+DgQl8QGkdh5q0xowArB25IwGEytJB8tF/:YpbYvA+8QlZpb5H+wArMIsytUt

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Tasks