General

  • Target

    9ce76256d7325af2e34f6c8f58db413c5d43f6fe.exe

  • Size

    260KB

  • Sample

    221130-k97pyaag7x

  • MD5

    12cffe89f637a3c6a0c1146acc676727

  • SHA1

    9ce76256d7325af2e34f6c8f58db413c5d43f6fe

  • SHA256

    9226a5552470fc7a251c1aaf5ca873e15c787cd9f7266e3d3977c8028e4036ce

  • SHA512

    bc5d97fcea187f080c8a231ebb41af4c7a7178cb917ee364e3fddfa8f54fced5236bffaa16ad6063d43fd6f1d154cd903c29c710b4f1724fb5375301cd3d0d4b

  • SSDEEP

    3072:/xTuGaG5aUYl8xJElSNtWK4P+Ni9eqtVyxsr60CzVAOYF7rXJ+7ouJ:pThx5aUYl8QlSNkWirtVyQ60Cpc7

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

110.36.234.146:80

191.82.16.60:80

91.83.93.105:8080

216.98.148.181:8080

68.183.190.199:8080

190.230.60.129:80

183.82.97.25:80

114.79.134.129:443

89.188.124.145:443

178.79.163.131:8080

76.69.29.42:80

87.106.77.40:7080

178.249.187.151:8080

62.75.143.100:7080

201.163.74.202:443

62.75.160.178:8080

181.188.149.134:80

186.0.95.172:80

217.199.160.224:8080

203.25.159.3:8080

rsa_pubkey.plain

Targets

    • Target

      9ce76256d7325af2e34f6c8f58db413c5d43f6fe.exe

    • Size

      260KB

    • MD5

      12cffe89f637a3c6a0c1146acc676727

    • SHA1

      9ce76256d7325af2e34f6c8f58db413c5d43f6fe

    • SHA256

      9226a5552470fc7a251c1aaf5ca873e15c787cd9f7266e3d3977c8028e4036ce

    • SHA512

      bc5d97fcea187f080c8a231ebb41af4c7a7178cb917ee364e3fddfa8f54fced5236bffaa16ad6063d43fd6f1d154cd903c29c710b4f1724fb5375301cd3d0d4b

    • SSDEEP

      3072:/xTuGaG5aUYl8xJElSNtWK4P+Ni9eqtVyxsr60CzVAOYF7rXJ+7ouJ:pThx5aUYl8QlSNkWirtVyQ60Cpc7

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Tasks