Overview

overview

10

Static

static

8

Electronic...23.doc

windows10-2004-x64

10

Resubmissions

09-03-2023 11:48

230309-nyd52abb2x 8

09-03-2023 11:41

230309-ntq9ssba91 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Electronic form 03.09.2023.zip

  • Size

    757KB

  • Sample

    230309-ntq9ssba91

  • MD5

    c9327f784504ed950ce96a293f75a2c7

  • SHA1

    e3fa57c7ef8febfdee7869c62e8cd172dd09b24f

  • SHA256

    7014c9f21b7cac747600b573f31a1e00f878ce07ef969810f219b244e1109bb2

  • SHA512

    503befa20ccc2a46eefff7b87a53c9552a0e72c1c7bc91f9e3490068f712029f0e9218f2b08aaa1bbaea4f1a8b7d08f53b74912bd4f14773e9d7158356078098

  • SSDEEP

    6144:OkjM/ZrZPtRQhpuTec+hFF1NGJsCCmIivTF2f8bKm6zBA7FjAvxtR9N9:lMZr1YpblFHpCCmRBbKm6l02bbN9

Score
10/10
emotetepoch4bankermacromacro_on_actiontrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

129.232.188.93:443

164.90.222.65:443

159.65.88.10:8080

172.105.226.75:8080

115.68.227.76:8080

187.63.160.88:80

169.57.156.166:8080

185.4.135.165:8080

153.126.146.25:7080

197.242.150.244:8080

139.59.126.41:443

186.194.240.217:443

103.132.242.26:8080

206.189.28.199:8080

163.44.196.120:8080

95.217.221.146:8080

159.89.202.34:443

119.59.103.152:8080

183.111.227.137:8080

201.94.166.162:443
eck1.plain
ecs1.plain

Targets

    • Target

      Electronic form 03.09.2023.doc

    • Size

      510.4MB

    • MD5

      871838759099c266f68e828e105971f5

    • SHA1

      c3e1d96b6880ddffe80544bdafce2b3c53cb6334

    • SHA256

      ef2af0a47057155445eb5daf7bcdfa1c2e32b8cd01d8cac79caec8698aa7dbd7

    • SHA512

      071d1c86e666657343279328a7dab53dc7e892e22c8d700faa96fab4f2b44c4960478fb9d24f6e0650c27a9043ed99c3bdfb7b33297c195c5fd484fed3853896

    • SSDEEP

      6144:ogJI9kbGiyDlVYoD2qe2qBgYZDyc+1Jg+CHf8biy/xllXQQgI2V:suyvDlGoUXZDyc0HCHf2Jxpg

    Score
    10/10
    emotetepoch4bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks