Malware sandboxing report by Hatching Triage

General

Target

2022-11-07-Excel-spreadsheet-for-Emotet-E4-X8099607585O.xls
Size

255KB
Sample

221122-qpdh9aea23
MD5

6493581b246b731e4937fbee64a68803
SHA1

a6e306f8841ff6fbd50188c738469143a6934df0
SHA256

199a2e0e1bb46a5dd8eb3a58aa55de157f6005c65b70245e71cecec4905cc2c0
SHA512

d4089c3cf61a73c1469e01ba2892f4c3e91b7aa3e020deba399581d4212da5ed8c1d4eec29531312643faa838d34bd38de33065373aa72b7cbb782ea5b8b5f60
SSDEEP

6144:NKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgzNiwrfx9rNFMMrttRzV5Dz3UxqC8LUcSu:ANbDjP9XH5XIqZLnSu

Score

10^/10

Malware Config

Extracted

Language	xlm4.0
Source
URLs	https://blacksebo.de/sharedassets/fA/ https://bikkviz.com/wp-admin/NyT44HkVg/ http://chist.com/dir-/HH/ http://coadymarine.com/Admin/ekamS7WWDkLwS44q/ xlm40.dropper https://blacksebo.de/sharedassets/fA/ xlm40.dropper https://bikkviz.com/wp-admin/NyT44HkVg/ xlm40.dropper http://chist.com/dir-/HH/ xlm40.dropper http://coadymarine.com/Admin/ekamS7WWDkLwS44q/

Extracted

Family	emotet
Botnet	Epoch4
C2	45.235.8.30:8080 94.23.45.86:4143 119.59.103.152:8080 169.60.181.70:8080 164.68.99.3:8080 172.105.226.75:8080 107.170.39.149:8080 206.189.28.199:8080 1.234.2.232:8080 188.44.20.25:443 186.194.240.217:443 103.43.75.120:443 149.28.143.92:443 159.89.202.34:443 209.97.163.214:443 183.111.227.137:8080 129.232.188.93:443 139.59.126.41:443 110.232.117.186:8080 139.59.56.73:8080 103.75.201.2:443 91.207.28.33:8080 164.90.222.65:443 197.242.150.244:8080 212.24.98.99:8080 51.161.73.194:443 115.68.227.76:8080 159.65.88.10:8080 201.94.166.162:443 95.217.221.146:8080 173.212.193.249:8080 82.223.21.224:8080 103.132.242.26:8080 213.239.212.5:443 153.126.146.25:7080 45.176.232.124:443 182.162.143.56:443 169.57.156.166:8080 159.65.140.115:443 163.44.196.120:8080 172.104.251.154:8080 167.172.253.162:8080 91.187.140.35:8080 45.118.115.99:8080 147.139.166.154:8080 72.15.201.15:8080 149.56.131.28:8080 167.172.199.165:8080 101.50.0.91:8080 160.16.142.56:8080 185.4.135.165:8080 104.168.155.143:8080 79.137.35.198:8080 5.135.159.50:443 187.63.160.88:80 45.235.8.30:8080 94.23.45.86:4143 119.59.103.152:8080 169.60.181.70:8080 164.68.99.3:8080 172.105.226.75:8080 107.170.39.149:8080 206.189.28.199:8080 1.234.2.232:8080 188.44.20.25:443 186.194.240.217:443 103.43.75.120:443 149.28.143.92:443 159.89.202.34:443 209.97.163.214:443 183.111.227.137:8080 129.232.188.93:443 139.59.126.41:443 110.232.117.186:8080 139.59.56.73:8080 103.75.201.2:443 91.207.28.33:8080 164.90.222.65:443 197.242.150.244:8080 212.24.98.99:8080 51.161.73.194:443 115.68.227.76:8080 159.65.88.10:8080 201.94.166.162:443 95.217.221.146:8080 173.212.193.249:8080 82.223.21.224:8080 103.132.242.26:8080 213.239.212.5:443 153.126.146.25:7080 45.176.232.124:443 182.162.143.56:443 169.57.156.166:8080 159.65.140.115:443 163.44.196.120:8080 172.104.251.154:8080 167.172.253.162:8080 91.187.140.35:8080 45.118.115.99:8080 147.139.166.154:8080 72.15.201.15:8080 149.56.131.28:8080 167.172.199.165:8080 101.50.0.91:8080 160.16.142.56:8080 185.4.135.165:8080 104.168.155.143:8080 79.137.35.198:8080 5.135.159.50:443 187.63.160.88:80
eck1.plain
ecs1.plain

Extracted

Language	xlm4.0
Source
URLs	https://blacksebo.de/sharedassets/fA/ https://bikkviz.com/wp-admin/NyT44HkVg/ xlm40.dropper https://blacksebo.de/sharedassets/fA/ xlm40.dropper https://bikkviz.com/wp-admin/NyT44HkVg/

Targets

- Target
  
  2022-11-07-Excel-spreadsheet-for-Emotet-E4-X8099607585O.xls
- Size
  
  255KB
- MD5
  
  6493581b246b731e4937fbee64a68803
- SHA1
  
  a6e306f8841ff6fbd50188c738469143a6934df0
- SHA256
  
  199a2e0e1bb46a5dd8eb3a58aa55de157f6005c65b70245e71cecec4905cc2c0
- SHA512
  
  d4089c3cf61a73c1469e01ba2892f4c3e91b7aa3e020deba399581d4212da5ed8c1d4eec29531312643faa838d34bd38de33065373aa72b7cbb782ea5b8b5f60
- SSDEEP
  
  6144:NKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgzNiwrfx9rNFMMrttRzV5Dz3UxqC8LUcSu:ANbDjP9XH5XIqZLnSu
Score

10^/10

emotet epoch4 banker trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Downloads MZ/PE file
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Modify Registry

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Targets

Emotet

Process spawned unexpected child process

Downloads MZ/PE file

Loads dropped DLL

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2