Overview

overview

10

Static

static

1

emotet_v6

windows10-1703-x64

8

emotet_doc

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    af0c7d355bb6a495d038fd05217209054107d31aa6199c491b74ae3d24b11c7e

  • Size

    61KB

  • Sample

    230323-a6dmksed4t

  • MD5

    45282862aeb428ffb5d4986704a8f4d5

  • SHA1

    fa2b0a82f3ca6bc7c00704556c9494b303613972

  • SHA256

    af0c7d355bb6a495d038fd05217209054107d31aa6199c491b74ae3d24b11c7e

  • SHA512

    db6457af502f45665ce4cc6573c5746607d8ffc661f0dcb224beceed93886f6c6194561cacc0efa543f0b2f62db976742f42c6c8102c5b11b65329757110b1db

  • SSDEEP

    768:6hKs7p4MAPEQbhh/8avllsFEaN3K19Z5zkzCIi5:6L7p4MafVLYEaN3K19ZWzCn5

Score
10/10
emotetepoch5bankerpersistencetrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

103.85.95.4:8080

103.224.241.74:8080

178.238.225.252:8080

37.59.103.148:8080

78.47.204.80:443

138.197.14.67:8080

128.199.242.164:8080

54.37.228.122:443

37.44.244.177:8080

139.59.80.108:8080

218.38.121.17:443

82.98.180.154:7080

114.79.130.68:443

159.65.135.222:7080

174.138.33.49:7080

195.77.239.39:8080

193.194.92.175:443

198.199.70.22:8080

85.214.67.203:8080

93.84.115.205:7080
ecs1.plain
eck1.plain

Targets

    • Target

      af0c7d355bb6a495d038fd05217209054107d31aa6199c491b74ae3d24b11c7e

    • Size

      61KB

    • MD5

      45282862aeb428ffb5d4986704a8f4d5

    • SHA1

      fa2b0a82f3ca6bc7c00704556c9494b303613972

    • SHA256

      af0c7d355bb6a495d038fd05217209054107d31aa6199c491b74ae3d24b11c7e

    • SHA512

      db6457af502f45665ce4cc6573c5746607d8ffc661f0dcb224beceed93886f6c6194561cacc0efa543f0b2f62db976742f42c6c8102c5b11b65329757110b1db

    • SSDEEP

      768:6hKs7p4MAPEQbhh/8avllsFEaN3K19Z5zkzCIi5:6L7p4MafVLYEaN3K19ZWzCn5

    Score
    10/10
    emotetepoch5bankerpersistencetrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks