Malware sandboxing report by Hatching Triage

General

Target

BF829517A6DAC2F780968DF6DB5B212A01EC269A353376EAA1B7D6EB306DCC9F
Size

91KB
Sample

221123-r2xy4adb6z
MD5

c44facac840cd5d8286c0a771dc0df4d
SHA1

bea1524c9dcbdeb63ab6073dae60ad071ad5db2c
SHA256

bf829517a6dac2f780968df6db5b212a01ec269a353376eaa1b7d6eb306dcc9f
SHA512

8e6f752450612fbe4d555e4f4e0372f62778311bf77740a8d0352a5b3861dc334e6d0c1ab953f2e82456884f8f6a498eabf3f17d540aa0a1acef4320d5a71ae5
SSDEEP

1536:vKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgHbCXuZH4gb4CEn9J4ZPX5:vKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgl

Score

10^/10

Malware Config

Extracted

Language	xlm4.0
Source
URLs	https://datie-tw.com/img/O8G0RDZj7MYCuJyPoP/ http://sbm.xinmoshiwang.com/upload/VaOfWEb3pW76UO/ https://copunupo.ac.zm/cgi-bin/WFFcGx/ http://ly.yjlianyi.top/wp-admin/4cChao/ xlm40.dropper https://datie-tw.com/img/O8G0RDZj7MYCuJyPoP/ xlm40.dropper http://sbm.xinmoshiwang.com/upload/VaOfWEb3pW76UO/ xlm40.dropper https://copunupo.ac.zm/cgi-bin/WFFcGx/ xlm40.dropper http://ly.yjlianyi.top/wp-admin/4cChao/

Extracted

Family	emotet
Botnet	Epoch4
C2	185.4.135.165:8080 159.89.202.34:443 82.223.21.224:8080 187.63.160.88:80 188.44.20.25:443 91.187.140.35:8080 110.232.117.186:8080 197.242.150.244:8080 119.59.103.152:8080 182.162.143.56:443 72.15.201.15:8080 173.255.211.88:443 206.189.28.199:8080 94.23.45.86:4143 45.63.99.23:7080 153.126.146.25:7080 45.118.115.99:8080 115.68.227.76:8080 163.44.196.120:8080 159.65.140.115:443 169.57.156.166:8080 139.59.56.73:8080 183.111.227.137:8080 202.129.205.3:8080 103.43.75.120:443 45.176.232.124:443 186.194.240.217:443 173.212.193.249:8080 139.59.126.41:443 149.56.131.28:8080 159.65.88.10:8080 201.94.166.162:443 107.170.39.149:8080 103.75.201.2:443 103.132.242.26:8080 209.97.163.214:443 129.232.188.93:443 79.137.35.198:8080 101.50.0.91:8080 147.139.166.154:8080 160.16.142.56:8080 153.92.5.27:8080 167.172.199.165:8080 95.217.221.146:8080 167.172.253.162:8080 164.90.222.65:443 172.105.226.75:8080 164.68.99.3:8080 213.239.212.5:443 91.207.28.33:8080 45.235.8.30:8080 172.104.251.154:8080 5.135.159.50:443 212.24.98.99:8080 104.168.155.143:8080 1.234.2.232:8080 185.4.135.165:8080 159.89.202.34:443 82.223.21.224:8080 187.63.160.88:80 188.44.20.25:443 91.187.140.35:8080 110.232.117.186:8080 197.242.150.244:8080 119.59.103.152:8080 182.162.143.56:443 72.15.201.15:8080 173.255.211.88:443 206.189.28.199:8080 94.23.45.86:4143 45.63.99.23:7080 153.126.146.25:7080 45.118.115.99:8080 115.68.227.76:8080 163.44.196.120:8080 159.65.140.115:443 169.57.156.166:8080 139.59.56.73:8080 183.111.227.137:8080 202.129.205.3:8080 103.43.75.120:443 45.176.232.124:443 186.194.240.217:443 173.212.193.249:8080 139.59.126.41:443 149.56.131.28:8080 159.65.88.10:8080 201.94.166.162:443 107.170.39.149:8080 103.75.201.2:443 103.132.242.26:8080 209.97.163.214:443 129.232.188.93:443 79.137.35.198:8080 101.50.0.91:8080 147.139.166.154:8080 160.16.142.56:8080 153.92.5.27:8080 167.172.199.165:8080 95.217.221.146:8080 167.172.253.162:8080 164.90.222.65:443 172.105.226.75:8080 164.68.99.3:8080 213.239.212.5:443 91.207.28.33:8080 45.235.8.30:8080 172.104.251.154:8080 5.135.159.50:443 212.24.98.99:8080 104.168.155.143:8080 1.234.2.232:8080
ecs1.plain
eck1.plain

Targets

- Target
  
  BF829517A6DAC2F780968DF6DB5B212A01EC269A353376EAA1B7D6EB306DCC9F
- Size
  
  91KB
- MD5
  
  c44facac840cd5d8286c0a771dc0df4d
- SHA1
  
  bea1524c9dcbdeb63ab6073dae60ad071ad5db2c
- SHA256
  
  bf829517a6dac2f780968df6db5b212a01ec269a353376eaa1b7d6eb306dcc9f
- SHA512
  
  8e6f752450612fbe4d555e4f4e0372f62778311bf77740a8d0352a5b3861dc334e6d0c1ab953f2e82456884f8f6a498eabf3f17d540aa0a1acef4320d5a71ae5
- SSDEEP
  
  1536:vKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgHbCXuZH4gb4CEn9J4ZPX5:vKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgl
Score

10^/10

emotet epoch4 banker trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Downloads MZ/PE file
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Modify Registry

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Emotet

Process spawned unexpected child process

Downloads MZ/PE file

Loads dropped DLL

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2