emotet

General

Target

5852826951552390283377037368.zip
Size

644KB
Sample

230310-hmx6waca57
MD5

efea2d8678b3927e36e025f4fdebab05
SHA1

3205cf01f7e58af23b01e600065699a5255254a5
SHA256

7f746e9f809a42c204791b96a39009116181cc8387dd1b9a18b5298542259325
SHA512

6ff9f610b8211c362ffb825c531b2c39de3b6b0e2445b53ef67fc9a548c83e218c781d6257df3042b8e57efa193e724cc0742d8b78448ba1aff059d48a2f95b3
SSDEEP

3072:s9KxsZJTw9U8wkt3d9Oi0jKXnacTBy1uhzhh8Q8TiqfMA2+DVfZx2ePQCOJEV:s93zn23Oi0uXnTZj+Q8TbfMAJ1xPQjJI

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

129.232.188.93:443

164.90.222.65:443

159.65.88.10:8080

172.105.226.75:8080

115.68.227.76:8080

187.63.160.88:80

169.57.156.166:8080

185.4.135.165:8080

153.126.146.25:7080

197.242.150.244:8080

139.59.126.41:443

186.194.240.217:443

103.132.242.26:8080

206.189.28.199:8080

163.44.196.120:8080

95.217.221.146:8080

159.89.202.34:443

119.59.103.152:8080

183.111.227.137:8080

201.94.166.162:443

eck1.plain

ecs1.plain

Targets

- Target
  
  5852826951552390283377037368.zip
- Size
  
  644KB
- MD5
  
  efea2d8678b3927e36e025f4fdebab05
- SHA1
  
  3205cf01f7e58af23b01e600065699a5255254a5
- SHA256
  
  7f746e9f809a42c204791b96a39009116181cc8387dd1b9a18b5298542259325
- SHA512
  
  6ff9f610b8211c362ffb825c531b2c39de3b6b0e2445b53ef67fc9a548c83e218c781d6257df3042b8e57efa193e724cc0742d8b78448ba1aff059d48a2f95b3
- SSDEEP
  
  3072:s9KxsZJTw9U8wkt3d9Oi0jKXnacTBy1uhzhh8Q8TiqfMA2+DVfZx2ePQCOJEV:s93zn23Oi0uXnTZj+Q8TbfMAJ1xPQjJI
Score

1^/10
behavioral1 behavioral2
- Target
  
  5852826951552390283377037368.doc
- Size
  
  507.2MB
- MD5
  
  9c2c9255706a88618328799742831333
- SHA1
  
  eb2a2742492738903fc285513e26d07e004d1d6c
- SHA256
  
  09244da710b8530420749d82861548c08e6a775e4f06765e1160756e802d9b47
- SHA512
  
  a2e45883139ebef0de551a75be4f62c13ace9a18f905d7f335e1b17b054bc59a48743dd7d26038ee7c1129faa25ef2d37b49506099589fa82e82870b97704545
- SSDEEP
  
  3072:vpt3LDPYvrTr3jvZNWGBStinoLVMcXyHtt5YC7EGIuGEMYDDK6:H3AvrTPRUGpmpXqWCoGIuGEMY
Score

10^/10

emotet epoch4 banker persistence trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral3 behavioral4

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Process spawned unexpected child process

Loads dropped DLL

Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4