emotet

General

Target

Contract - Mar 09, 2023.zip
Size

739KB
Sample

230309-qkxfkace52
MD5

9b367c6496d6ccc73c832c89f4d8ef80
SHA1

4de3e5d88bb24ad7c156cbbc7cb11632b4f19298
SHA256

edfd8e518a46b0fde90bf7c2276dd64107a2e09b360cf02f4ffd03a6e6e42d0b
SHA512

42d4a9be27d97c968a7c777b3dfae53a322bced3ce5e26ab4c55edc019702cb58b117e2cdc099ab5d11cf1f08247198379a10439086b8090f585f6b76789a60f
SSDEEP

6144:O2OPYgKAapWp7q0CYcB906oP6FnpamsXp+YIDK/vj9xHsQUsXbN:sggCwZq0CvfS0np0om/vBxMBsB

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

129.232.188.93:443

164.90.222.65:443

159.65.88.10:8080

172.105.226.75:8080

115.68.227.76:8080

187.63.160.88:80

169.57.156.166:8080

185.4.135.165:8080

153.126.146.25:7080

197.242.150.244:8080

139.59.126.41:443

186.194.240.217:443

103.132.242.26:8080

206.189.28.199:8080

163.44.196.120:8080

95.217.221.146:8080

159.89.202.34:443

119.59.103.152:8080

183.111.227.137:8080

201.94.166.162:443

eck1.plain

ecs1.plain

Targets

- Target
  
  Contract - Mar-09-2023.doc
- Size
  
  522.3MB
- MD5
  
  31f97ce2bbc58266f6eb92213f1a2454
- SHA1
  
  3be2b2eb3215d451dc475d63048eee889da48cbc
- SHA256
  
  62ab0b86d0eda61c16827847de2edf4920558f8e4c6b63eb720a09e6dea6f734
- SHA512
  
  a1c36524b14f633d2346b369ecc07b23a549793c842f50452d3189218cad32bf871113368a98c531f5575e041affe76f2c144875f9cf378e39378495ff6393f7
- SSDEEP
  
  6144:QDuxuMOZCBtANveapnaWVgsaNlbfXhoEHC87pnkTnlzIWZ4:18yGZZak8fxJB1e5IWZ4
Score

10^/10

emotet epoch4 banker trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Process spawned unexpected child process

Loads dropped DLL

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2