General

  • Target

    60b78de0cffbb7ad2956e7e117d831dedbb1088e08eba2da0336072f5f260152

  • Size

    911KB

  • Sample

    230308-m1wbnaff89

  • MD5

    4f78a41ab8f3b0c989e4929873e7abbb

  • SHA1

    959bc023d31114fba3bde3ff2622ab8baddbf6db

  • SHA256

    60b78de0cffbb7ad2956e7e117d831dedbb1088e08eba2da0336072f5f260152

  • SHA512

    3ec96d51fa8f00aa905d8df91ad03546f468fd55558668ea0b70b5ec276df2f36276e0380e0021226319b55449fd9d907d6a034b2e2a0ce965964714d7e12e98

  • SSDEEP

    6144:VIahm9n1uy/GnwjLlPVlwZ07Qpz5VvtMgcFqjlOwnERXQqEvFNNyqmmODa:VIznz/GnwjLltlwIKzz1DtwwAXEvxyFy

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

129.232.188.93:443

164.90.222.65:443

159.65.88.10:8080

172.105.226.75:8080

115.68.227.76:8080

187.63.160.88:80

169.57.156.166:8080

185.4.135.165:8080

153.126.146.25:7080

197.242.150.244:8080

139.59.126.41:443

186.194.240.217:443

103.132.242.26:8080

206.189.28.199:8080

163.44.196.120:8080

95.217.221.146:8080

159.89.202.34:443

119.59.103.152:8080

183.111.227.137:8080

201.94.166.162:443

eck1.plain
ecs1.plain

Targets

    • Target

      Invio documento rif.3125332 del 08.03.2023.doc

    • Size

      543.6MB

    • MD5

      59f1c43382bca8e1fad2b698bf25d4ba

    • SHA1

      6b6e8f4fcf94f71446a72af97a6738cd6af1000a

    • SHA256

      f5498c6f589a41cdd73f82f7aff91ebf1690874b98cdb2a617e0d9b7cb3ac3f7

    • SHA512

      f2638b19fd731fe7337e573e4d0131b5f3676debdd997fcdd8bb10a67627d653ae7f4d2696e087c721c9f4b1c6f09ed1f82342c90be75dd05ad547e18f907bac

    • SSDEEP

      12288:sSVFHNUr1LCHFIAHrQk6VDL6P+4f1IzSmkuH3gv:sSVFH48HFIABZfSzQ

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks