Overview

overview

10

Static

static

1

f3842cd4b6...ec.dll

windows7-x64

10

f3842cd4b6...ec.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f3842cd4b63be5212f9d13436938759fc5d1966bdad0cec0819f87cfbfb3adec.zip

  • Size

    175KB

  • Sample

    230208-lxwycahe6y

  • MD5

    69099be647d18d6cb6d9b285979a2e8e

  • SHA1

    e38504ff8b1c6fd0c4e23ffbb4ef0d77f9c4a084

  • SHA256

    7cddd51f10fca53125553bd311350abd2ccee4a53bc488544893f45194b69b53

  • SHA512

    2172ac708bbfa4b28653f7d55fa41be7c99f0d267bad48cf850825271232058e5537316caaf641d84da8b3fd30d1aa32f67a333255a500fd597d480a81ddc725

  • SSDEEP

    3072:93eHqsJOABfnvHDQ/h/rwTkgTvEuOcHlxiz5PXuOhDS4kcPvhexXO5pXDOSH7XdT:ZYzO0fnvHDQ/5rwQgTv2elxihpm/xXOn

Score
10/10
emotetepoch1bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

184.66.18.83:80

202.187.222.40:80

167.71.148.58:443

211.215.18.93:8080

1.234.65.61:80

80.15.100.37:80

155.186.9.160:80

172.104.169.32:8080

110.39.162.2:443

12.162.84.2:8080

181.136.190.86:80

68.183.190.199:8080

191.223.36.170:80

190.45.24.210:80

81.213.175.132:80

181.120.29.49:80

82.76.111.249:443

177.23.7.151:80

95.76.153.115:80

93.148.247.169:80
rsa_pubkey.plain

Targets

    • Target

      f3842cd4b63be5212f9d13436938759fc5d1966bdad0cec0819f87cfbfb3adec.dll

    • Size

      233KB

    • MD5

      5aefd49a03a4810e6dd2b73395deb12b

    • SHA1

      7706a62fa35616037c6ce35d71eea6fa10cc0eac

    • SHA256

      f3842cd4b63be5212f9d13436938759fc5d1966bdad0cec0819f87cfbfb3adec

    • SHA512

      2e622a4c7cc2da5a4dee64823fa42b499749fd473dee5d0e9703e08b8d4f564b57a8eb6c75eb057d02d25f81ccc851f1ab266ab68ae4c3eb8c266a8cc8bf44ff

    • SSDEEP

      3072:KC1sUJsEIoECTFM5/A8eWLdlU8thEnYsqibnjPw+a5DIYvK8UIDoQQh3:KC1NJMoEywAkdrHEn1qibjm5DIYSX

    Score
    10/10
    emotetepoch1bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks