Overview

overview

10

Static

static

1

TqZsa3RNkA...f7.zip

windows7-x64

1

TqZsa3RNkA...f7.zip

windows10-2004-x64

1

U5gLza.dll

windows7-x64

10

U5gLza.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    TqZsa3RNkAXH2YdOK8cXgqf7.zip

  • Size

    845KB

  • Sample

    230318-ffrdmsdc8s

  • MD5

    00c1fb994efa5fcacbd4f0529a15d806

  • SHA1

    11f05001b90c6870de7991735c192b2fde1f6cd4

  • SHA256

    cb40f27d30303310dafe6ba1460bb7dd7ae66d49ecff28e6ad8a3c67b5321858

  • SHA512

    795c095464838966728276b9f2736a8a7a02165d7099b236373b688f0c1779fdaafd87cb14cad3cec9dfa9e3fa16cdb887ef4837c853c8a58579fab33fe54777

  • SSDEEP

    6144:/A/fqQLsh2uoOObj+gmM424czDPECwRAc7cDA08yuMol3G:I/fqmm2sObC7ezET7vh73G

Score
10/10
emotetepoch5bankerpersistencetrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

103.85.95.4:8080

103.224.241.74:8080

178.238.225.252:8080

37.59.103.148:8080

78.47.204.80:443

138.197.14.67:8080

128.199.242.164:8080

54.37.228.122:443

37.44.244.177:8080

139.59.80.108:8080

218.38.121.17:443

82.98.180.154:7080

114.79.130.68:443

159.65.135.222:7080

174.138.33.49:7080

195.77.239.39:8080

193.194.92.175:443

198.199.70.22:8080

85.214.67.203:8080

93.84.115.205:7080
ecs1.plain
eck1.plain

Targets

    • Target

      TqZsa3RNkAXH2YdOK8cXgqf7.zip

    • Size

      845KB

    • MD5

      00c1fb994efa5fcacbd4f0529a15d806

    • SHA1

      11f05001b90c6870de7991735c192b2fde1f6cd4

    • SHA256

      cb40f27d30303310dafe6ba1460bb7dd7ae66d49ecff28e6ad8a3c67b5321858

    • SHA512

      795c095464838966728276b9f2736a8a7a02165d7099b236373b688f0c1779fdaafd87cb14cad3cec9dfa9e3fa16cdb887ef4837c853c8a58579fab33fe54777

    • SSDEEP

      6144:/A/fqQLsh2uoOObj+gmM424czDPECwRAc7cDA08yuMol3G:I/fqmm2sObC7ezET7vh73G

    Score
    1/10
    behavioral1behavioral2

    • Target

      U5gLza.dll

    • Size

      538.5MB

    • MD5

      2f999c6dd783aebb414a797505677546

    • SHA1

      aea48806c2788799c52bd6b515fe7959f74a54e4

    • SHA256

      69f371a7d7a88345e08e1e463b6a23863b5d5aed2eb09a14b814dac182685d7e

    • SHA512

      db593e05804a08e000bcf7e7c98f8964ec0b9e3a384966adeb8c688433c9aaaac8d56a9e16a8318110a2483d884bf54069c488bb793132e0ae974fde7270d954

    • SSDEEP

      12288:chQZR06Fy1F5YqSDZ9ma2aCStos1F3uD2Hescq2mc:jT08y1F5YqSDZ9ma21Str3cTX

    Score
    10/10
    emotetepoch5bankertrojanpersistence
    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks