General

  • Target

    P44G.dll

  • Size

    330KB

  • Sample

    230204-mrzbysdb27

  • MD5

    2e9c671da19f38080c83e31a8b33899d

  • SHA1

    377f254d1d03d5438c2f223a5eb263aae4a29d93

  • SHA256

    2b19492ecb4811ab74ba978cc641c0d6e957c016e6f690a93ecceea9301ac1f9

  • SHA512

    9d15cdcd8e7111378c47118ba56b1bbd522e6fc9a06eb60e9fa9ae71f05560a56b9dc8005d17e2acd6a1e630d12a9849790ce73ff812ba845e6226aceb05afa4

  • SSDEEP

    3072:1Rq1sFAd2gQ5PmBvNZwnnq1gn2RvoXiDzAYgrO1v2F5j8LZ9:Pq1sFAwgwmBv3wnIgG4oAYxvU54l9

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

139.72.1.139:4160

0.22.10.252:35656

1.139.72.72:35656

10.234.21.255:22

0.1.80.141:18432

3.86.211.232:18432

0.2.176.36:18432

0.0.2.96:24385

92.65.93.65:24159

204.204.204.204:52428

36.92.137.72:18440

72.87.16.36:60547

139.72.218.139:17913

133.69.51.117:29888

203.188.13.56:31

31.215.179.53:29696

5.139.55.137:39496

192.51.3.137:35656

116.139.72.48:14372

195.95.32.196:59596

rsa_pubkey.plain

Targets

    • Target

      P44G.dll

    • Size

      330KB

    • MD5

      2e9c671da19f38080c83e31a8b33899d

    • SHA1

      377f254d1d03d5438c2f223a5eb263aae4a29d93

    • SHA256

      2b19492ecb4811ab74ba978cc641c0d6e957c016e6f690a93ecceea9301ac1f9

    • SHA512

      9d15cdcd8e7111378c47118ba56b1bbd522e6fc9a06eb60e9fa9ae71f05560a56b9dc8005d17e2acd6a1e630d12a9849790ce73ff812ba845e6226aceb05afa4

    • SSDEEP

      3072:1Rq1sFAd2gQ5PmBvNZwnnq1gn2RvoXiDzAYgrO1v2F5j8LZ9:Pq1sFAwgwmBv3wnIgG4oAYxvU54l9

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Blocklisted process makes network request

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Tasks