emotet

General

Target

3214.msg
Size

687KB
Sample

230309-pbmpbsbb81
MD5

4a83c8beff9e08b5d7a717a0eebf0955
SHA1

0aefb48c163a2c234bb10459fa5f9e2464b7a371
SHA256

555ddfa62cfdc159d6722c17778de3cd52f5c7d1948f6ac375f5888afc63c133
SHA512

22fdebaa49408025ce59cd13eb2a88c109881a00d5bd76e86575de681ac964b549692c2cb1990bcb0c26fe233b47db959067bf5dbf2b4bb44b9a1f2b9b33812e
SSDEEP

6144:2/kq7JNbwmfcuHom8Hz2f//ywiWT8xVTI5wq:qbbPHom8TYyCT8x5I5w

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

129.232.188.93:443

164.90.222.65:443

159.65.88.10:8080

172.105.226.75:8080

115.68.227.76:8080

187.63.160.88:80

169.57.156.166:8080

185.4.135.165:8080

153.126.146.25:7080

197.242.150.244:8080

139.59.126.41:443

186.194.240.217:443

103.132.242.26:8080

206.189.28.199:8080

163.44.196.120:8080

95.217.221.146:8080

159.89.202.34:443

119.59.103.152:8080

183.111.227.137:8080

201.94.166.162:443

eck1.plain

ecs1.plain

Targets

- Target
  
  Stratosphere.co.zip
- Size
  
  654KB
- MD5
  
  f391cae678c2bbf3cea7710d6ee07a2f
- SHA1
  
  f7361a93dfbf3db285878656f1b27732a94eecb8
- SHA256
  
  f44d067f6a4d8248521c7c073294680dfe8556207c1fda6c98602e6cb5ab25c2
- SHA512
  
  30bd36d0e3c7af2965a70d2d6adc10aee5e975b32a49e9d5fce83d03aeeaf4b3c436f1f6297c266dd42c02665060bd36870a1e75bb3541a0d3e9f8be9a34bdd1
- SSDEEP
  
  6144:JJNbwmfcuHom8Hz2f//ywiWT8xVTI5wqF:tbPHom8TYyCT8x5I5wK
Score

1^/10
behavioral1
- Target
  
  59127688180328585892998__2023-08-03_1113.doc
- Size
  
  504.3MB
- MD5
  
  237e055e64b8ca9b54e2217646bfc60e
- SHA1
  
  30cd06e2e15ccfb9b07d62d5f38692a8f6a9b5a4
- SHA256
  
  17eca4943b3040c47babe49d2d1f59f4852695e2348fe107ec935e38416e511b
- SHA512
  
  99ffa51951c364b941160153ea714a281ebf51cdc6307fffe9405a3ce13442352871134293e61009f3661c184f7827624afdc4ca1edc5d54c86e24b2c322b8e7
- SSDEEP
  
  6144:xPn4VZXbatu7MDogsDkHS50LdfcGcbz1f5M9KTFrMpSlMK3Ru+Q28:xP4PbNMkgg3Ru+x
Score

10^/10

emotet epoch4 banker trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Loads dropped DLL
behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Process spawned unexpected child process

Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2