General

  • Target

    55f283c0ee87a122e3b7428a60490bff80da01ac.exe

  • Size

    492KB

  • Sample

    221130-lcg9fsgc64

  • MD5

    9547c2132fdd1422d3bcb4de2a95d530

  • SHA1

    55f283c0ee87a122e3b7428a60490bff80da01ac

  • SHA256

    6a6904fe007845787df332920919c2a1f968de70f288a29a410f3e46da5501bd

  • SHA512

    77fa3972a41bc308103efb5b2cd32698d64622afc34b0627e89f2afc32417b02a5127981a41c4b48874e80f98849b15fcfd21025679eebb2e63fb99acc5cd764

  • SSDEEP

    6144:bTj57Z0Lnr0s1pWxD14XLN9JpFAeSeDXrJl3PvgJ6zU5hfQCGw6QpTGHzTvaFbg9:pPs/WIXLHJp2VYXrJ5PvfUvszTvuc

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

110.36.234.146:80

191.82.16.60:80

91.83.93.105:8080

216.98.148.181:8080

68.183.190.199:8080

190.230.60.129:80

183.82.97.25:80

114.79.134.129:443

89.188.124.145:443

178.79.163.131:8080

76.69.29.42:80

87.106.77.40:7080

178.249.187.151:8080

62.75.143.100:7080

201.163.74.202:443

62.75.160.178:8080

181.188.149.134:80

186.0.95.172:80

217.199.160.224:8080

203.25.159.3:8080

rsa_pubkey.plain

Targets

    • Target

      55f283c0ee87a122e3b7428a60490bff80da01ac.exe

    • Size

      492KB

    • MD5

      9547c2132fdd1422d3bcb4de2a95d530

    • SHA1

      55f283c0ee87a122e3b7428a60490bff80da01ac

    • SHA256

      6a6904fe007845787df332920919c2a1f968de70f288a29a410f3e46da5501bd

    • SHA512

      77fa3972a41bc308103efb5b2cd32698d64622afc34b0627e89f2afc32417b02a5127981a41c4b48874e80f98849b15fcfd21025679eebb2e63fb99acc5cd764

    • SSDEEP

      6144:bTj57Z0Lnr0s1pWxD14XLN9JpFAeSeDXrJl3PvgJ6zU5hfQCGw6QpTGHzTvaFbg9:pPs/WIXLHJp2VYXrJ5PvfUvszTvuc

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Tasks