Overview

overview

10

Static

static

021a1efecc...fe.dll

windows7-x64

10

021a1efecc...fe.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    021a1efecc97353b727a20c791d45de30535a6df9086ceecd7c2d950d4ddc1fe.7z

  • Size

    170KB

  • Sample

    221117-kv1cbaaa9s

  • MD5

    c2f93f796059d28f1fabba59b278ecb1

  • SHA1

    b8a11d01b4c69fed430c82928413b57c55e19a4c

  • SHA256

    e749c96f54b25e571b95c44acf5a69ce2d26f728f1a9eff9b49a38bd4f5e1ae8

  • SHA512

    f38b4b3e4f2a747c96d97ee99c433f187f900023f8d87fe4e357019926b5ae1deca7e7102aa8ccbd5068e75c3c362a7dd0f1ef94ecfb10cc10f12a87e2525661

  • SSDEEP

    3072:fz5vEpb/C9fYV7MWRISB42QSZ/8u3B0UwzeIYUjqvFzztkPGwHbXADn8uyTUn6ns:Fk/gfYVAWCSBz/8u3BTLKAFzzSGw7XE9

Score
10/10
emotetepoch4bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

91.200.186.228:443

191.252.196.221:8080

94.177.248.64:443

66.42.55.5:7080

103.8.26.103:8080

185.184.25.237:8080

103.8.26.102:8080

178.79.147.66:8080

58.227.42.236:80

45.118.135.203:7080

103.75.201.2:443

195.154.133.20:443

45.142.114.231:8080

212.237.5.209:443

207.38.84.195:8080

104.251.214.46:8080

212.237.17.99:8080

212.237.56.116:7080

216.158.226.206:443

110.232.117.186:8080
eck1.plain
ecs1.plain

Targets

    • Target

      021a1efecc97353b727a20c791d45de30535a6df9086ceecd7c2d950d4ddc1fe

    • Size

      252KB

    • MD5

      f1af783cf914d837baa223b58dc55671

    • SHA1

      317b63257544201ef7ee47b8287cbe6aec145b8c

    • SHA256

      021a1efecc97353b727a20c791d45de30535a6df9086ceecd7c2d950d4ddc1fe

    • SHA512

      685e065693e1d386a6e9e6a720f2af72f26cacc912820e0ca5080bb2d07c94a2f77c2e33e2734d9a9a87ce60585a068e4052f181a65ea96f2c87753aee88a779

    • SSDEEP

      6144:ndH09uYgR7OJSuwuZc2HEaYTy7beWTBdgm:dHJtlec2HEaYTXWT/N

    Score
    10/10
    emotetepoch4bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks