General

  • Target

    cd85f250-b0e5-bfcd-24ff-fde4febbf706.eml

  • Size

    924KB

  • Sample

    230308-h9rbvaef43

  • MD5

    00c48415988e54a05ee4a5c2f7ea0ded

  • SHA1

    b4eb381af1180b0ecf9326eba9ca80e4eed2c353

  • SHA256

    7051272374b28001b457f586c12e83a4e3324f17cdc68af06aca3d3bed02c05a

  • SHA512

    a8ac724fc53ad8464377ea00cbc42632c2ccf78b0a81d9d4d5f502fd6c62923496cb025b361a62efab9c41cf6ec4136c977fd7e3d2e410a6c8bef386a3a3747f

  • SSDEEP

    3072:H36LS+QaZfOb2esTkQUTL+JAF7cHnCiUtcjovYDiagstZAPtbFY2Wjlr0xSK511:H36uEObAnA+JACHCiN5TQ7Mlr0sU11

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

129.232.188.93:443

164.90.222.65:443

159.65.88.10:8080

172.105.226.75:8080

115.68.227.76:8080

187.63.160.88:80

169.57.156.166:8080

185.4.135.165:8080

153.126.146.25:7080

197.242.150.244:8080

139.59.126.41:443

186.194.240.217:443

103.132.242.26:8080

206.189.28.199:8080

163.44.196.120:8080

95.217.221.146:8080

159.89.202.34:443

119.59.103.152:8080

183.111.227.137:8080

201.94.166.162:443

eck1.plain
ecs1.plain

Targets

    • Target

      cd85f250-b0e5-bfcd-24ff-fde4febbf706.eml

    • Size

      924KB

    • MD5

      00c48415988e54a05ee4a5c2f7ea0ded

    • SHA1

      b4eb381af1180b0ecf9326eba9ca80e4eed2c353

    • SHA256

      7051272374b28001b457f586c12e83a4e3324f17cdc68af06aca3d3bed02c05a

    • SHA512

      a8ac724fc53ad8464377ea00cbc42632c2ccf78b0a81d9d4d5f502fd6c62923496cb025b361a62efab9c41cf6ec4136c977fd7e3d2e410a6c8bef386a3a3747f

    • SSDEEP

      3072:H36LS+QaZfOb2esTkQUTL+JAF7cHnCiUtcjovYDiagstZAPtbFY2Wjlr0xSK511:H36uEObAnA+JACHCiN5TQ7Mlr0sU11

    Score
    6/10
    • Accesses Microsoft Outlook profiles

    • Drops file in System32 directory

    • Target

      K-1 03.07.2023.zip

    • Size

      646KB

    • MD5

      325a68cf9734c7c60f6857015fad14e7

    • SHA1

      4698b1eaa31c75111546e5247f01219be26cb402

    • SHA256

      d81768f23e4cf38d75e49b7a754914cc0a275cb766aafc4e599907d8712f9d1a

    • SHA512

      85dd003ac2123edfe57e69c158161e243d495f5806228fca9cfade1a9aa39e11f889c018cc8311705bd2eafb95c04bd924e3cacab99954a4d24bbad8391223c5

    • SSDEEP

      3072:01lsI//z4a/hGS0NclN3U8XKp5ZuoWkQQhl0GEzal3CP:012c/z4a5GLNIp1WMkd3tCP

    Score
    1/10
    • Target

      K-1 03.07.2023.doc

    • Size

      527.2MB

    • MD5

      fd37aece5d1c1538fdaab4b4fa1fa16a

    • SHA1

      101fbc6beec580efc3582c7f619c711e9fb6d385

    • SHA256

      d9988c6dcd1c169af8db5bc3c363f18f66501a63dd9fc1b671ad32f5de359472

    • SHA512

      99cc15b540873054513d9f3fb13b250b253ab77ca83c45b350af17d04572b76db67c5f176627aaa8741113bc26d6890a15bde794557065dc9c341a65a4c13fb0

    • SSDEEP

      3072:eoEW2aOtFjH0lP2IpjctfRcVVwEi/A8NVM1wIOCbX6bYLjWFJuvx7ueK6:ZE1aOtFa2I9c3aVw4zwxCbJ4Jup

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Loads dropped DLL

    • Adds Run key to start application

    • Target

      email-html-1.txt

    • Size

      23KB

    • MD5

      dc66858d0ab79d70fb738ff81105ace1

    • SHA1

      bd5f9c9bc8f1a0560a1536e48bbe3af06a127339

    • SHA256

      c7c781ea2b4571c242c1b631339395e0777b4ccf381f9709d606901639d60c2c

    • SHA512

      84261aafc34849b61237a0899a23f867357f9849603ed1160263ee0528f46a8553a093a5e570e74a5331f808c3cf5078438abeff993fadb42312a77cc4b1ebe1

    • SSDEEP

      384:i71Ce/fO3AtYVSjJjjTPlKnM4foW08aP3YZYvVFvXmvKD32YoziyI5NCc7dM9J2C:fCJnzlKnM4foW08aP3YZYvVFvXmvKD3U

    Score
    1/10

MITRE ATT&CK Enterprise v6

Tasks