General

  • Target

    3a4uoSOec70ypNOT1wMHzQXgn.dll

  • Size

    796KB

  • Sample

    230630-pxpqtacb45

  • MD5

    874b811ba8aca19ecb2c17b1fdad88b0

  • SHA1

    b1af2af2bad3bb2ee6e4fbf11e50965a60f0e400

  • SHA256

    13cfd306936b3cb7470eb5c5ac209437d267c3ff2875235ebc31d4d146239e4b

  • SHA512

    302330b83615df66652a3974eb42a84b51a281beb0f23db49024f551e414e6ab8bd4d22275d49a22c744183b7d525dc539e5c111b934d49342726704d8d3a295

  • SSDEEP

    12288:KVHML2QJe6XxhqCW4QHR5f/jsVL6TwEHJlTeRNV52:GML2QJNxhqgQHXj1p0RN

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

45.76.1.145:443

217.182.25.250:8080

119.193.124.41:7080

192.99.251.50:443

146.59.226.45:443

173.212.193.249:8080

207.38.84.195:8080

45.118.135.203:7080

31.24.158.56:8080

209.126.98.206:8080

212.237.17.99:8080

216.158.226.206:443

50.30.40.196:8080

82.165.152.127:8080

159.8.59.82:8080

107.182.225.142:8080

110.232.117.186:8080

72.15.201.15:8080

5.9.116.246:8080

79.172.212.216:8080

eck1.plain
ecs1.plain

Targets

    • Target

      3a4uoSOec70ypNOT1wMHzQXgn.dll

    • Size

      796KB

    • MD5

      874b811ba8aca19ecb2c17b1fdad88b0

    • SHA1

      b1af2af2bad3bb2ee6e4fbf11e50965a60f0e400

    • SHA256

      13cfd306936b3cb7470eb5c5ac209437d267c3ff2875235ebc31d4d146239e4b

    • SHA512

      302330b83615df66652a3974eb42a84b51a281beb0f23db49024f551e414e6ab8bd4d22275d49a22c744183b7d525dc539e5c111b934d49342726704d8d3a295

    • SSDEEP

      12288:KVHML2QJe6XxhqCW4QHR5f/jsVL6TwEHJlTeRNV52:GML2QJNxhqgQHXj1p0RN

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Matrix

Tasks