General

  • Target

    Avnet.zip

  • Size

    652KB

  • Sample

    230308-dttptadg48

  • MD5

    f1c6510e295a3304415635a2a4b9c164

  • SHA1

    5322e253e9353f84aa9d5818f75ec9d5ab6e5aa0

  • SHA256

    2b75594be1689a10dc56b48e968a737f4b685e8cb9a744514608212050e92a09

  • SHA512

    976d8c8fc1de18b77263488aaed645c16bb5704498a8a28566708e1c9cc245e9edc28e1a891253cc598baf95e51561c257787359103df1500fb9f7973f8621ee

  • SSDEEP

    6144:EJNbwmfcuHom8Hz2f//ywiWT8xVTI5wqh:obPHom8TYyCT8x5I5wI

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

129.232.188.93:443

164.90.222.65:443

159.65.88.10:8080

172.105.226.75:8080

115.68.227.76:8080

187.63.160.88:80

169.57.156.166:8080

185.4.135.165:8080

153.126.146.25:7080

197.242.150.244:8080

139.59.126.41:443

186.194.240.217:443

103.132.242.26:8080

206.189.28.199:8080

163.44.196.120:8080

95.217.221.146:8080

159.89.202.34:443

119.59.103.152:8080

183.111.227.137:8080

201.94.166.162:443

eck1.plain
ecs1.plain

Targets

    • Target

      8018884277287430213822548__2023-08-03_1114.doc

    • Size

      501.3MB

    • MD5

      0b73336fd74afdbaa04abb044c6733fd

    • SHA1

      1f91b4b74c9643631318b4d58f6660bb4d292782

    • SHA256

      922116d96a87d62e02fb7571b39e943929b3a9774dc3ddc47c503cecae42d0b1

    • SHA512

      99141d9b8694a12e89134c2ebd91b2887a7011df4b44498ff55471314ca57bfeabbf30ee90800d9b68615b7c730fda496123b1083378b2c44457e22df044f3e6

    • SSDEEP

      6144:xPn4VZXbatu7MDogsDkHS50LdfcGcbz1f5M9KTFrMpSlMK3Ru+Q28:xP4PbNMkgg3Ru+x

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks