Resubmissions

14-04-2023 09:45

230414-lref4sag7y 4

06-04-2023 21:59

230406-1wjzqahc31 10

General

  • Target

    County Report - 2023-03-22_1840 Proforce.one

  • Size

    261KB

  • Sample

    230406-1wjzqahc31

  • MD5

    9795d088beb0df278f051037cfe74374

  • SHA1

    9bb3b6c35de0ec6610dc2e0478bff2a11ec25efe

  • SHA256

    b19fe34a8e54908728a9d7abaf2972ee224a42735e361619997ac976f699c4f9

  • SHA512

    bb433977fadca160d3c751f8da0fce443a6465f196668743acc72c93b3135f7cac55934671f252503c1cec6d67317988c6b86a204d66369dedd736bb9e6407f5

  • SSDEEP

    3072:xXzeHrBwsHzUfxJ3mY2IsGllOb3HPWaBtOzUfxJ3mY2IsGllOb3HPWaBtuX3:FeHrBwsYXm5ZGa3vRXm5ZGa3v6

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

213.239.212.5:443

129.232.188.93:443

103.43.75.120:443

197.242.150.244:8080

1.234.2.232:8080

110.232.117.186:8080

95.217.221.146:8080

159.89.202.34:443

159.65.88.10:8080

82.223.21.224:8080

169.57.156.166:8080

45.176.232.124:443

45.235.8.30:8080

173.212.193.249:8080

107.170.39.149:8080

119.59.103.152:8080

167.172.199.165:8080

91.207.28.33:8080

185.4.135.165:8080

104.168.155.143:8080

eck1.plain
ecs1.plain

Targets

    • Target

      County Report - 2023-03-22_1840 Proforce.one

    • Size

      261KB

    • MD5

      9795d088beb0df278f051037cfe74374

    • SHA1

      9bb3b6c35de0ec6610dc2e0478bff2a11ec25efe

    • SHA256

      b19fe34a8e54908728a9d7abaf2972ee224a42735e361619997ac976f699c4f9

    • SHA512

      bb433977fadca160d3c751f8da0fce443a6465f196668743acc72c93b3135f7cac55934671f252503c1cec6d67317988c6b86a204d66369dedd736bb9e6407f5

    • SSDEEP

      3072:xXzeHrBwsHzUfxJ3mY2IsGllOb3HPWaBtOzUfxJ3mY2IsGllOb3HPWaBtuX3:FeHrBwsYXm5ZGa3vRXm5ZGa3v6

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Tasks