Overview

overview

10

Static

static

8

Partner.ciena.zip

windows10-1703-x64

1

5912768818...13.doc

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    12324.msg

  • Size

    687KB

  • Sample

    230309-nngs6sba8s

  • MD5

    08921e14b8376e1e55e4bbc4bee8c597

  • SHA1

    fcbf3cc7c856eaeb4d255bcc6ac5f9860773cd00

  • SHA256

    2e2f2c4dcba454f05ab3fae30f7a91cd0f1f05c4e90605d4c28d1d68e3c39069

  • SHA512

    6267e0a1c43141b121215345968fcdd3150918ab8c083af6e81df419a70da366b08f1b957f37dff26bcf52d161ba078583466212d7d4b3e479cc180e26ae3e8a

  • SSDEEP

    6144:cc7JNbwmfcuHom8Hz2f//ywiWT8xVTI5wq:NbPHom8TYyCT8x5I5w

Score
10/10
emotetepoch4bankermacromacro_on_actiontrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

129.232.188.93:443

164.90.222.65:443

159.65.88.10:8080

172.105.226.75:8080

115.68.227.76:8080

187.63.160.88:80

169.57.156.166:8080

185.4.135.165:8080

153.126.146.25:7080

197.242.150.244:8080

139.59.126.41:443

186.194.240.217:443

103.132.242.26:8080

206.189.28.199:8080

163.44.196.120:8080

95.217.221.146:8080

159.89.202.34:443

119.59.103.152:8080

183.111.227.137:8080

201.94.166.162:443
eck1.plain
ecs1.plain

Targets

    • Target

      Partner.ciena.zip

    • Size

      654KB

    • MD5

      f391cae678c2bbf3cea7710d6ee07a2f

    • SHA1

      f7361a93dfbf3db285878656f1b27732a94eecb8

    • SHA256

      f44d067f6a4d8248521c7c073294680dfe8556207c1fda6c98602e6cb5ab25c2

    • SHA512

      30bd36d0e3c7af2965a70d2d6adc10aee5e975b32a49e9d5fce83d03aeeaf4b3c436f1f6297c266dd42c02665060bd36870a1e75bb3541a0d3e9f8be9a34bdd1

    • SSDEEP

      6144:JJNbwmfcuHom8Hz2f//ywiWT8xVTI5wqF:tbPHom8TYyCT8x5I5wK

    Score
    1/10
    behavioral1

    • Target

      59127688180328585892998__2023-08-03_1113.doc

    • Size

      504.3MB

    • MD5

      237e055e64b8ca9b54e2217646bfc60e

    • SHA1

      30cd06e2e15ccfb9b07d62d5f38692a8f6a9b5a4

    • SHA256

      17eca4943b3040c47babe49d2d1f59f4852695e2348fe107ec935e38416e511b

    • SHA512

      99ffa51951c364b941160153ea714a281ebf51cdc6307fffe9405a3ce13442352871134293e61009f3661c184f7827624afdc4ca1edc5d54c86e24b2c322b8e7

    • SSDEEP

      6144:xPn4VZXbatu7MDogsDkHS50LdfcGcbz1f5M9KTFrMpSlMK3Ru+Q28:xP4PbNMkgg3Ru+x

    Score
    10/10
    emotetepoch4bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks