General

  • Target

    UUIW_99950751.zip

  • Size

    653KB

  • Sample

    230308-gzpvlaec97

  • MD5

    06f87219d644a86d284731c7dacd8100

  • SHA1

    ff96c89021980d68be97284773fbd06345f024ca

  • SHA256

    b8c1f06dbbe199412a19a58f60b46e4b94641a392d1fdafcb378ed26e9e537b4

  • SHA512

    60d9c50a646b5b4af89645987476f210674892acb658f6ac6b0c9f35651cfa47cb965033b2f60a04ced672aebdc67d450c60c3e4c500496a2295f91123ca88cd

  • SSDEEP

    6144:jJNbwmfcuHom8Hz2f//ywiWT8xVTI5wqL:3bPHom8TYyCT8x5I5wI

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

129.232.188.93:443

164.90.222.65:443

159.65.88.10:8080

172.105.226.75:8080

115.68.227.76:8080

187.63.160.88:80

169.57.156.166:8080

185.4.135.165:8080

153.126.146.25:7080

197.242.150.244:8080

139.59.126.41:443

186.194.240.217:443

103.132.242.26:8080

206.189.28.199:8080

163.44.196.120:8080

95.217.221.146:8080

159.89.202.34:443

119.59.103.152:8080

183.111.227.137:8080

201.94.166.162:443

eck1.plain
ecs1.plain

Targets

    • Target

      Invoice Copies 2023-03-07_1554, United States.doc

    • Size

      502.3MB

    • MD5

      a59e9fe46fe7ccd8c74b1dc39553d1a5

    • SHA1

      6b2699157dd7bb19cdb7f0ffb959c20c90318e9c

    • SHA256

      4792472bd90dab5885a789793a3309109b7f8d305203faa011d92b0efdf1720b

    • SHA512

      cfc9951ccf2e7001184b71855c1074c5c8a74b8739494121f5df6f8151d90af6ff5f9ea6b524f71fc4d5b3a3ded608172372c49cb9f7771c6594cb19d179435d

    • SSDEEP

      6144:xPn4VZXbatu7MDogsDkHS50LdfcGcbz1f5M9KTFrMpSlMK3Ru+Q28:xP4PbNMkgg3Ru+x

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks