General

  • Target

    e4-34535fb29a1bf69eb16d9ea0cb5c62ba.dll

  • Size

    601KB

  • Sample

    221117-ljfzzaea89

  • MD5

    34535fb29a1bf69eb16d9ea0cb5c62ba

  • SHA1

    500cf6559a1166516c79c2adbc32c18d99bff744

  • SHA256

    922893ebe3bb892f6df179fde4cdb8e0dfca5f097f724266b2a2ab5a1d476558

  • SHA512

    cdab6db92e76faa09acd7452c1a0072060285b5521ae3c68d68b51dd7c42427a73922661b9194f5d51873f8b56042babd401db8266d20c8b339d4c256720f3e0

  • SSDEEP

    12288:6vJFr4/wR7H3b57SXQdL4sFQ9cPhx1yN3Rihv:6xuIR7L578QdLX5Phby9Yv

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

185.4.135.165:8080

159.89.202.34:443

82.223.21.224:8080

187.63.160.88:80

188.44.20.25:443

91.187.140.35:8080

110.232.117.186:8080

197.242.150.244:8080

119.59.103.152:8080

182.162.143.56:443

72.15.201.15:8080

173.255.211.88:443

206.189.28.199:8080

94.23.45.86:4143

45.63.99.23:7080

153.126.146.25:7080

45.118.115.99:8080

115.68.227.76:8080

163.44.196.120:8080

159.65.140.115:443

ecs1.plain
eck1.plain

Targets

    • Target

      e4-34535fb29a1bf69eb16d9ea0cb5c62ba.dll

    • Size

      601KB

    • MD5

      34535fb29a1bf69eb16d9ea0cb5c62ba

    • SHA1

      500cf6559a1166516c79c2adbc32c18d99bff744

    • SHA256

      922893ebe3bb892f6df179fde4cdb8e0dfca5f097f724266b2a2ab5a1d476558

    • SHA512

      cdab6db92e76faa09acd7452c1a0072060285b5521ae3c68d68b51dd7c42427a73922661b9194f5d51873f8b56042babd401db8266d20c8b339d4c256720f3e0

    • SSDEEP

      12288:6vJFr4/wR7H3b57SXQdL4sFQ9cPhx1yN3Rihv:6xuIR7L578QdLX5Phby9Yv

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Tasks