Overview

overview

10

Static

static

0041d82cc2...c7.dll

windows7-x64

10

0041d82cc2...c7.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0041d82cc2a5bb2f447f9c40989292675232cb8404bbfa751c9b961e2f6149c7.7z

  • Size

    170KB

  • Sample

    221123-mjk5cseb93

  • MD5

    6149828a6ba79c623c8162c77d980761

  • SHA1

    f9090d3f7f3ccc87b4256299b22b6fb406180f11

  • SHA256

    95074111b40c889773f454cddab91d9c098751e603f4958a3f06de9bdd1111fe

  • SHA512

    8bbaaa2205c62bebbc1c70c46236984e3ccb07663b13d0dbc21c5e68e25863d7f764d2c41870780a22b84534d8329f5e28dc57fb1b099c3c74d3e725e5a738cb

  • SSDEEP

    3072:m6308JieKeonjTsCkg+jaxXmcFbjJiu0gWbQ+LsRB7D0N:rZiNZjIk+jkpFbjsQUsR5oN

Score
10/10
emotetepoch4bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

81.0.236.93:443

94.177.248.64:443

66.42.55.5:7080

103.8.26.103:8080

185.184.25.237:8080

45.76.176.10:8080

188.93.125.116:8080

103.8.26.102:8080

178.79.147.66:8080

58.227.42.236:80

45.118.135.203:7080

103.75.201.2:443

195.154.133.20:443

45.142.114.231:8080

212.237.5.209:443

207.38.84.195:8080

104.251.214.46:8080

138.185.72.26:8080

51.68.175.8:8080

210.57.217.132:8080
eck1.plain
ecs1.plain

Targets

    • Target

      0041d82cc2a5bb2f447f9c40989292675232cb8404bbfa751c9b961e2f6149c7

    • Size

      252KB

    • MD5

      4499a07c65463afe5387d59917e4cbb1

    • SHA1

      df26b148867821c4b6eb3cce65c65832db90cfca

    • SHA256

      0041d82cc2a5bb2f447f9c40989292675232cb8404bbfa751c9b961e2f6149c7

    • SHA512

      82a142ccffbe930fdf6f27e375821c4003af587c2bf0b2c6a5970bb95b43536e723f9e8af0632de5bb83409ed814122da1809e84cc655878e025f5596036f6b8

    • SSDEEP

      3072:PtgItJoMl9eJ02kGuBDhk3VsbwVBQdP6ZkiaoZa74jZUUzdDIm6O80MTcdfokHJL:OHK9eSBFA+bwVB35tMTc5ocEFWTBHz

    Score
    10/10
    emotetepoch4bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks