emotet

General

Target

0aaa19a9dab44d3a8b2a295437a359c3267f464531023b5635b2138cd431456d
Size

261KB
Sample

230322-v4g77sad35
MD5

0f0ecd85a1a57d7f7a251f1eae8e8a85
SHA1

d8a609b2f4b3927eb8894cb8ca419e9ec4ff8373
SHA256

0aaa19a9dab44d3a8b2a295437a359c3267f464531023b5635b2138cd431456d
SHA512

8f932b9ffa8d090dc67fe33e464a854a5af965a43f7ca732e81c48c06f710b9d14ff98878240c03a36009411d20d9a2b6ed8106d483c87bcc44b85ea2e44cf1c
SSDEEP

3072:xXzeHrBwsHzUfxJ3mY2IsGllOb3HPWaBtOzUfxJ3mY2IsGllOb3HPWaBtuXO:FeHrBwsYXm5ZGa3vRXm5ZGa3vb

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

213.239.212.5:443

129.232.188.93:443

103.43.75.120:443

197.242.150.244:8080

1.234.2.232:8080

110.232.117.186:8080

95.217.221.146:8080

159.89.202.34:443

159.65.88.10:8080

82.223.21.224:8080

169.57.156.166:8080

45.176.232.124:443

45.235.8.30:8080

173.212.193.249:8080

107.170.39.149:8080

119.59.103.152:8080

167.172.199.165:8080

91.207.28.33:8080

185.4.135.165:8080

104.168.155.143:8080

eck1.plain

ecs1.plain

Targets

- Target
  
  0aaa19a9dab44d3a8b2a295437a359c3267f464531023b5635b2138cd431456d
- Size
  
  261KB
- MD5
  
  0f0ecd85a1a57d7f7a251f1eae8e8a85
- SHA1
  
  d8a609b2f4b3927eb8894cb8ca419e9ec4ff8373
- SHA256
  
  0aaa19a9dab44d3a8b2a295437a359c3267f464531023b5635b2138cd431456d
- SHA512
  
  8f932b9ffa8d090dc67fe33e464a854a5af965a43f7ca732e81c48c06f710b9d14ff98878240c03a36009411d20d9a2b6ed8106d483c87bcc44b85ea2e44cf1c
- SSDEEP
  
  3072:xXzeHrBwsHzUfxJ3mY2IsGllOb3HPWaBtOzUfxJ3mY2IsGllOb3HPWaBtuXO:FeHrBwsYXm5ZGa3vRXm5ZGa3vb
Score

10^/10

emotet epoch4 banker trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Process spawned unexpected child process

Blocklisted process makes network request

Checks computer location settings

Loads dropped DLL

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2