General

  • Target

    4e8205cbf31f1c4378feed1327cf6d1a9cac0d33.exe

  • Size

    284KB

  • Sample

    221130-k4fz2aac4x

  • MD5

    20afd1814233fe9b3627302224b9fa7d

  • SHA1

    4e8205cbf31f1c4378feed1327cf6d1a9cac0d33

  • SHA256

    c725c4069b6bc088bd634654961e60ed09c5bb1aa35b214b6a86a86dd63da8e6

  • SHA512

    26b067621dfb1d080ee30d9033a1107fd59f3e1f8cb54b2a6f0ada386f3c11ac094d03335da7d3f6687398b334ba1d4d04af9d878891da1891577b0320e0a90d

  • SSDEEP

    3072:CZLoRwD74vV9Xo/yO7jh6xIWxRzEmSegqtVqcQKuk5fmCyUBY51JzMl:LRikV+TfMZzwmO6JQk5fEoK

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

110.36.234.146:80

191.82.16.60:80

91.83.93.105:8080

216.98.148.181:8080

68.183.190.199:8080

190.230.60.129:80

183.82.97.25:80

114.79.134.129:443

89.188.124.145:443

178.79.163.131:8080

76.69.29.42:80

87.106.77.40:7080

178.249.187.151:8080

62.75.143.100:7080

201.163.74.202:443

62.75.160.178:8080

181.188.149.134:80

186.0.95.172:80

217.199.160.224:8080

203.25.159.3:8080

rsa_pubkey.plain

Targets

    • Target

      4e8205cbf31f1c4378feed1327cf6d1a9cac0d33.exe

    • Size

      284KB

    • MD5

      20afd1814233fe9b3627302224b9fa7d

    • SHA1

      4e8205cbf31f1c4378feed1327cf6d1a9cac0d33

    • SHA256

      c725c4069b6bc088bd634654961e60ed09c5bb1aa35b214b6a86a86dd63da8e6

    • SHA512

      26b067621dfb1d080ee30d9033a1107fd59f3e1f8cb54b2a6f0ada386f3c11ac094d03335da7d3f6687398b334ba1d4d04af9d878891da1891577b0320e0a90d

    • SSDEEP

      3072:CZLoRwD74vV9Xo/yO7jh6xIWxRzEmSegqtVqcQKuk5fmCyUBY51JzMl:LRikV+TfMZzwmO6JQk5fEoK

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Tasks