General

  • Target

    de53c5ea5dee3fcc8b6a9f8a6926aa84d1434408e968205f0e8ef94250c8f3a8

  • Size

    93KB

  • Sample

    230323-wfeylshc57

  • MD5

    4452f951ec5390c7cd0397d659717b4d

  • SHA1

    1ddf3284b015fb3e7dba3157ba6c81511a9c9402

  • SHA256

    de53c5ea5dee3fcc8b6a9f8a6926aa84d1434408e968205f0e8ef94250c8f3a8

  • SHA512

    9f72c23a9975d1745b97a8b454695ffd6272410acb9d71ec7e1c5d479cfce6deb09aecd2f3cc49ed1c5307d0f5be788498e9c01876cbfc2b2255c38ff4b549bd

  • SSDEEP

    1536:fh7OdS2cokRMkxS8qDAHfhhBqrHBsNZqHqbuh7jGMkVh7Ufqjx3RFtDGXo6BICuQ:fh7OdS2cokRMkxS8qDAHJhorHBsNZqHB

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

213.239.212.5:443

129.232.188.93:443

103.43.75.120:443

197.242.150.244:8080

1.234.2.232:8080

110.232.117.186:8080

95.217.221.146:8080

159.89.202.34:443

159.65.88.10:8080

82.223.21.224:8080

169.57.156.166:8080

45.176.232.124:443

45.235.8.30:8080

173.212.193.249:8080

107.170.39.149:8080

119.59.103.152:8080

167.172.199.165:8080

91.207.28.33:8080

185.4.135.165:8080

104.168.155.143:8080

eck1.plain
ecs1.plain

Targets

    • Target

      de53c5ea5dee3fcc8b6a9f8a6926aa84d1434408e968205f0e8ef94250c8f3a8

    • Size

      93KB

    • MD5

      4452f951ec5390c7cd0397d659717b4d

    • SHA1

      1ddf3284b015fb3e7dba3157ba6c81511a9c9402

    • SHA256

      de53c5ea5dee3fcc8b6a9f8a6926aa84d1434408e968205f0e8ef94250c8f3a8

    • SHA512

      9f72c23a9975d1745b97a8b454695ffd6272410acb9d71ec7e1c5d479cfce6deb09aecd2f3cc49ed1c5307d0f5be788498e9c01876cbfc2b2255c38ff4b549bd

    • SSDEEP

      1536:fh7OdS2cokRMkxS8qDAHfhhBqrHBsNZqHqbuh7jGMkVh7Ufqjx3RFtDGXo6BICuQ:fh7OdS2cokRMkxS8qDAHJhorHBsNZqHB

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Blocklisted process makes network request

    • Loads dropped DLL

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Query Registry

1
T1012

Tasks