Overview

overview

10

Static

static

8

Rech.doc

windows7-x64

10

Rech.doc

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Rech.zip

  • Size

    658KB

  • Sample

    230314-n88gmahc2x

  • MD5

    bcb2124ab204306a2bf5a9648ec9df50

  • SHA1

    1bfc6a543bc2691c456b19bbbb3038a8926dd9f3

  • SHA256

    953d4204061b6047b1e877ac36eafa05ac2a1ed18d664e087b479b59ed65f75a

  • SHA512

    0c1c2bd3edef379425fab59e44fcca58f148c4aa4e633f3a3efb8aa42559dafec6205069b3268c38b4bae9caf19547394007fa28c1e7420142fd38f4b55fb1cb

  • SSDEEP

    3072:5IFb4Wmkqke+cEeqH9vH+i2s1Vj8JxuLVpMs75XLKZvP:5Oykqk6Lw+i2s1Vjkxuxp/QvP

Score
10/10
emotetepoch4bankermacromacro_on_actiontrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

164.68.99.3:8080

164.90.222.65:443

186.194.240.217:443

1.234.2.232:8080

103.75.201.2:443

187.63.160.88:80

147.139.166.154:8080

91.207.28.33:8080

5.135.159.50:443

153.92.5.27:8080

213.239.212.5:443

103.43.75.120:443

159.65.88.10:8080

167.172.253.162:8080

153.126.146.25:7080

119.59.103.152:8080

107.170.39.149:8080

183.111.227.137:8080

159.89.202.34:443

110.232.117.186:8080
eck1.plain
ecs1.plain

Targets

    • Target

      Rech.doc

    • Size

      503.3MB

    • MD5

      4ba3208978bd0a61df72015340c72d14

    • SHA1

      927ed9e1883ce74b59728b11cd3f7956e151e4bf

    • SHA256

      ce7baabab7bc9cdf8584f53f87283d96a763d6a1c5ca141b801ce8e7eb909597

    • SHA512

      8d6b18ed26cd7ac4f000c4ea75d0aad935eabb3379da8a884994cf6963f395595bd4494ebe2f3823831f918bd1176ccdfea50b2d07375cf2ce5070fed1c6e403

    • SSDEEP

      6144:1620tqUx3Xu+7ZkRIDNGi9a0Va5UAClo:1620tqm3+I2ezcz5U3lo

    Score
    10/10
    emotetepoch4bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks