General

  • Target

    3d2531d788fa976a21ef9b3ca6bea9cf97384237bb52a67c3f8087df585fccdd

  • Size

    601KB

  • Sample

    221117-lfeyhaab3w

  • MD5

    040b334ea70ec65765f9ddfbc671e062

  • SHA1

    67225af63050839f602297f80687b9d4a5a7b1db

  • SHA256

    3d2531d788fa976a21ef9b3ca6bea9cf97384237bb52a67c3f8087df585fccdd

  • SHA512

    32a08350969862cbdc3cd7f48bca921ba105177c36ad5f0da2640c3a09d7f763ffc46d50a30717ff7ebbd34a6f23ecff9850e557086bda297e84c8ea6d4cafa8

  • SSDEEP

    12288:6vJFr4/wR7H3b57MXQdL4sFQ9cPhx1yN3Rihv:6xuIR7L57+QdLX5Phby9Yv

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

185.4.135.165:8080

159.89.202.34:443

82.223.21.224:8080

187.63.160.88:80

188.44.20.25:443

91.187.140.35:8080

110.232.117.186:8080

197.242.150.244:8080

119.59.103.152:8080

182.162.143.56:443

72.15.201.15:8080

173.255.211.88:443

206.189.28.199:8080

94.23.45.86:4143

45.63.99.23:7080

153.126.146.25:7080

45.118.115.99:8080

115.68.227.76:8080

163.44.196.120:8080

159.65.140.115:443

ecs1.plain
eck1.plain

Targets

    • Target

      3d2531d788fa976a21ef9b3ca6bea9cf97384237bb52a67c3f8087df585fccdd

    • Size

      601KB

    • MD5

      040b334ea70ec65765f9ddfbc671e062

    • SHA1

      67225af63050839f602297f80687b9d4a5a7b1db

    • SHA256

      3d2531d788fa976a21ef9b3ca6bea9cf97384237bb52a67c3f8087df585fccdd

    • SHA512

      32a08350969862cbdc3cd7f48bca921ba105177c36ad5f0da2640c3a09d7f763ffc46d50a30717ff7ebbd34a6f23ecff9850e557086bda297e84c8ea6d4cafa8

    • SSDEEP

      12288:6vJFr4/wR7H3b57MXQdL4sFQ9cPhx1yN3Rihv:6xuIR7L57+QdLX5Phby9Yv

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Tasks