emotet

General

Target

945f0137edf3f3b018911d7c5e6dd911_icedid_JC.exe
Size

456KB
Sample

230825-rj7etaec5t
MD5

945f0137edf3f3b018911d7c5e6dd911
SHA1

3d04fd5dad65156a5a3893702cb3e25d5e680546
SHA256

02c7820dfd11f8e8a442b069e6fe15116737b43b57a337a2b4ddcb47215cc2d4
SHA512

c86804033293789e0503f106980debd1cadedcb8b1a4e69093ae64950fa78cd8bd3eb9eb2e207bbc27f2bf0691905d210f0d562e85f02e68923fc2ceb5992b05
SSDEEP

12288:qhmHCOuI/PHoBrRro9Jx3w8n/vEhZhRg:tHCzI34rCPEQ

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

78.206.229.130:80

104.131.92.244:8080

70.39.251.94:8080

87.230.25.43:8080

79.118.74.90:80

82.76.111.249:443

82.76.52.155:80

212.71.237.140:8080

188.251.213.180:80

103.236.179.162:80

1.226.84.243:8080

70.32.84.74:8080

2.84.12.98:80

201.213.177.139:80

177.73.0.98:443

170.81.48.2:80

129.232.220.11:8080

177.144.130.105:8080

213.52.74.198:80

120.72.18.91:80

rsa_pubkey.plain

Targets

- Target
  
  945f0137edf3f3b018911d7c5e6dd911_icedid_JC.exe
- Size
  
  456KB
- MD5
  
  945f0137edf3f3b018911d7c5e6dd911
- SHA1
  
  3d04fd5dad65156a5a3893702cb3e25d5e680546
- SHA256
  
  02c7820dfd11f8e8a442b069e6fe15116737b43b57a337a2b4ddcb47215cc2d4
- SHA512
  
  c86804033293789e0503f106980debd1cadedcb8b1a4e69093ae64950fa78cd8bd3eb9eb2e207bbc27f2bf0691905d210f0d562e85f02e68923fc2ceb5992b05
- SSDEEP
  
  12288:qhmHCOuI/PHoBrRro9Jx3w8n/vEhZhRg:tHCzI34rCPEQ
Score

10^/10

emotet epoch1 banker trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Emotet payload
  Detects Emotet payload in memory.
  trojan banker
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Emotet payload

Executes dropped EXE

Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2