Overview

overview

10

Static

static

8

9110984242...56.xls

windows7-x64

10

9110984242...56.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    911098424236C6749830B8751A1B03AB47F321D12BDE3CD141B9A47057501956

  • Size

    91KB

  • Sample

    221123-r2sdlsdb4v

  • MD5

    57f864a7c022461d5364b9550e693b8b

  • SHA1

    9716e358e3fdc45a89d545a1fa7e827c5b7e2169

  • SHA256

    911098424236c6749830b8751a1b03ab47f321d12bde3cd141b9a47057501956

  • SHA512

    471896e38c0c7fdcf228d7db1f7fae9e56ae81afbc308113ba191faa0bc1d7e7603f03574cdc9e9e9da413eef539903dec4924204b44c690e56fd39ffddfbfdd

  • SSDEEP

    1536:vKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgHbCXuZH4gb4CEn9J4ZvX5:vKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgF

Score
10/10
emotetepoch4bankermacropersistencetrojanxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://datie-tw.com/img/O8G0RDZj7MYCuJyPoP/
xlm40.dropper

http://sbm.xinmoshiwang.com/upload/VaOfWEb3pW76UO/
xlm40.dropper

https://copunupo.ac.zm/cgi-bin/WFFcGx/
xlm40.dropper

http://ly.yjlianyi.top/wp-admin/4cChao/

Extracted

Family

emotet

Botnet

Epoch4

C2

185.4.135.165:8080

159.89.202.34:443

82.223.21.224:8080

187.63.160.88:80

188.44.20.25:443

91.187.140.35:8080

110.232.117.186:8080

197.242.150.244:8080

119.59.103.152:8080

182.162.143.56:443

72.15.201.15:8080

173.255.211.88:443

206.189.28.199:8080

94.23.45.86:4143

45.63.99.23:7080

153.126.146.25:7080

45.118.115.99:8080

115.68.227.76:8080

163.44.196.120:8080

159.65.140.115:443
ecs1.plain
eck1.plain

Targets

    • Target

      911098424236C6749830B8751A1B03AB47F321D12BDE3CD141B9A47057501956

    • Size

      91KB

    • MD5

      57f864a7c022461d5364b9550e693b8b

    • SHA1

      9716e358e3fdc45a89d545a1fa7e827c5b7e2169

    • SHA256

      911098424236c6749830b8751a1b03ab47f321d12bde3cd141b9a47057501956

    • SHA512

      471896e38c0c7fdcf228d7db1f7fae9e56ae81afbc308113ba191faa0bc1d7e7603f03574cdc9e9e9da413eef539903dec4924204b44c690e56fd39ffddfbfdd

    • SSDEEP

      1536:vKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgHbCXuZH4gb4CEn9J4ZvX5:vKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgF

    Score
    10/10
    emotetepoch4bankertrojanpersistence

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks