Overview

overview

10

Static

static

3

q7BQAFT0.dll

windows10-2004-x64

10

RAddjxpwj2...Nl.dll

windows10-2004-x64

10

HPKhTEMLxA...00.dll

windows10-2004-x64

10

Electronic...23.one

windows10-2004-x64

6

W-9 Dt 03.22.2023.one

windows10-2004-x64

6

doc_0322.one

windows10-2004-x64

6

form 03.22...il.one

windows10-2004-x64

6

press to u...nt.vbs

windows10-2004-x64

10

Resubmissions

13-09-2023 20:47

230913-zk1mnahe68 10

13-09-2023 19:55

230913-ym9snsef2y 10

13-09-2023 19:49

230913-yjtbhshc66 3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2023-03-22-Emotet-malware-samples.zip

  • Size

    1.9MB

  • Sample

    230913-ym9snsef2y

  • MD5

    dd96bc22ea8919bcc30d7c3313b29103

  • SHA1

    eede57aad77bb1737e9c37b90afee1ea3931e8ec

  • SHA256

    52380fa4188daab8d7e884c71da9e39e80048d7cfe373d0a5e197bd14fb43521

  • SHA512

    ef17e4fa93445efcc0e2376dbe37d183e8b5663fe1f39a3b6851c465ec230651eb2595bb60999590bf9f367a99ba28de19fb2043028dd83a8c4d7e7a482c6368

  • SSDEEP

    49152:OKW7tMAJ3GGKDTGiIyFHw3J+IriiGJ+6GO:TW7tMkqT7Hw3J+ein86GO

Score
10/10
emotetepoch4bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

213.239.212.5:443

129.232.188.93:443

103.43.75.120:443

197.242.150.244:8080

1.234.2.232:8080

110.232.117.186:8080

95.217.221.146:8080

159.89.202.34:443

159.65.88.10:8080

82.223.21.224:8080

169.57.156.166:8080

45.176.232.124:443

45.235.8.30:8080

173.212.193.249:8080

107.170.39.149:8080

119.59.103.152:8080

167.172.199.165:8080

91.207.28.33:8080

185.4.135.165:8080

104.168.155.143:8080
eck1.plain
ecs1.plain

Targets

    • Target

      q7BQAFT0.dll

    • Size

      530.9MB

    • MD5

      08d40c504500c324b683773b1c6189d9

    • SHA1

      ef4e4454c0839fb3f7ecb352faa53b199c9975b6

    • SHA256

      0f3ba94e10c72a31ef11bcf580ddbdabb43b5ed37b84638db1c973a1577c9be3

    • SHA512

      5cd9ee4d9503fae7b4b0280bc63cba11fd4fa29db64e3bab3e782233929c0b79a9612b25031bddf4b9e61cf7db0fe41ab7bf646bd519d7ff178d153b4d0bc1ae

    • SSDEEP

      12288:6iWi2RszBxSICcO5w6SudYEW/N4HTJ4NYu3cX:4inOcO5wJVETHTJwYusX

    Score
    10/10
    emotetepoch4bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet
    behavioral1

    • Target

      RAddjxpwj24w2YPhNNlkljCCW1mNl.dll

    • Size

      548.9MB

    • MD5

      1f6da9241678e8027198488394442e80

    • SHA1

      63a7fe6ff07e358a1dfacb5eb8299ba47acd5444

    • SHA256

      ff3eba9a8324180ea6153844bab8ab3d08dc179f717acfc4ee74248e57cae203

    • SHA512

      27c1075e437c000db35a71c8d5480806ad8bd60adbb11eadd0ca37b93eee84d569d2f25e443170507534c1e9bfaf8ca5ce6bac2141469424d9cc14682c49ce18

    • SSDEEP

      12288:6iWi2RszBxSICcO5w6SudYEW/N4HTJ4NYu3cX:4inOcO5wJVETHTJwYusX

    Score
    10/10
    emotetepoch4bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet
    behavioral2

    • Target

      HPKhTEMLxAwWRn14Bn9w1Sj9aW00.dll

    • Size

      511.9MB

    • MD5

      0586fe01aea41856828a347dddf2121c

    • SHA1

      3b3183691cede18ff4a8b35104c3dcc99c2583f8

    • SHA256

      c8a777959691f310d36c30f18f10f523be55fe55c86f7d3b556bd31ebb5d6126

    • SHA512

      37b99147f938426c81bd0628c99775ca8b94667bf4a2eab5660e301e01cad348c2552f74e9cdb97994e1f29aa7cd30d4c83e294f9e01a445034177f174a71c79

    • SSDEEP

      12288:6iWi2RszBxSICcO5w6SudYEW/N4HTJ4NYu3cX:4inOcO5wJVETHTJwYusX

    Score
    10/10
    emotetepoch4bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet
    behavioral3

    • Target

      Electronic form 03.22.2023.one

    • Size

      261KB

    • MD5

      f6fd612e5a9435e9d682445f6eedf822

    • SHA1

      726f1f38404a42f92650c647d68cee94c0ceea7a

    • SHA256

      49b6ecc7fc09944ad7ae6456458cbf0c9c7284ad8e371fcbd791d1e8cd809dee

    • SHA512

      196e17a1871e81609e2328dd018c4ba946bbb8749d53d221afb27a5ff75dd06b860deac21389a00905a7d522616a690cb5d4f17e5459b5e86c60337aa727eab0

    • SSDEEP

      3072:xXzeHrBwsHzUfxJ3mY2IsGllOb3HPWaBtOzUfxJ3mY2IsGllOb3HPWaBtuXJ:FeHrBwsYXm5ZGa3vRXm5ZGa3vg

    Score
    6/10

    • Process spawned suspicious child process

      This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

    behavioral4

    • Target

      W-9 Dt 03.22.2023.one

    • Size

      261KB

    • MD5

      1899fbd81deb47c0548728d9d9ee6d6c

    • SHA1

      37b22e29a750d80c05ab412d0883854a2f153009

    • SHA256

      127600f09554e8fd36639ba78bfeefa255f8674e014d3e345732dad82693d804

    • SHA512

      2ca73c383a25c46345363686eaeb984e6b788af0bac3089ab96099ecd7e8280fcf3cdb897f311be7fbe70d78fb042029e5eb8ade24083097c585f01c27f78b23

    • SSDEEP

      3072:xXzeHrBwsHzUfxJ3mY2IsGllOb3HPWaBtOzUfxJ3mY2IsGllOb3HPWaBtuXv:FeHrBwsYXm5ZGa3vRXm5ZGa3ve

    Score
    6/10

    • Process spawned suspicious child process

      This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

    behavioral5

    • Target

      doc_0322.one

    • Size

      261KB

    • MD5

      03e8285045cf9dcf8aaf6aa5173e9405

    • SHA1

      ed25287886244cf4ef5849da33c4a35352cfeecd

    • SHA256

      0f358a71775ad9224f77547f23c75333fabcdfa089abf80a68f6703cd4885080

    • SHA512

      998386ad433408b94d92e7231022004337a3732db24ac591d273494a22f7ffe1294d6f7a8fa61919ca0131a4a7b040917645f6ea85b761b582c0841e309bd669

    • SSDEEP

      3072:xXzeHrBwsHzUfxJ3mY2IsGllOb3HPWaBtOzUfxJ3mY2IsGllOb3HPWaBtuXq:FeHrBwsYXm5ZGa3vRXm5ZGa3v7

    Score
    6/10

    • Process spawned suspicious child process

      This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

    behavioral6

    • Target

      form 03.22.2023 Gmail.one

    • Size

      261KB

    • MD5

      680c7dd9215c94bc4c6ba51bdfa43540

    • SHA1

      b9311d4e871f0c04ceae3276d3719025d5aed546

    • SHA256

      4de23bba14b8208a50658e40f77f9dc06cc5a46422bb9ae6fce4655e61893309

    • SHA512

      ce092697c44eef08b9a8a8854f5b9693c978bc798e1850d1ac56ede542fbcf9ee82737757b7a8e8f847e3db4ff0f2c78be0d2f31ad7690fc3d91a5cf092d9f4a

    • SSDEEP

      3072:xXzeHrBwsHzUfxJ3mY2IsGllOb3HPWaBtOzUfxJ3mY2IsGllOb3HPWaBtuXy:FeHrBwsYXm5ZGa3vRXm5ZGa3vb

    Score
    6/10

    • Process spawned suspicious child process

      This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

    behavioral7

    • Target

      press to unblock document.vbs

    • Size

      89KB

    • MD5

      7559f0ff4f7e58ed031fe0b4438f4c57

    • SHA1

      e2225573a8877c057319e10029fd85b0a51375a8

    • SHA256

      73527befbcc1ec6716003fc875d578c40e3dfe619349ff288008bab33c90e5d2

    • SHA512

      252d0a52c3b7bca5ea56a14c7ad1e27967b03e3dccfc3b8d79b8e1c474ed625937719af314e74f62583c708b45b937091e8fae7f1e40e56bf261d0f839f94e4a

    • SSDEEP

      384:6/EHPbchpdLrwUkRI8K5mAX3E53EnoUyd4989GgFWfYyLxgaHxixxOD/n3FiSf+y:6/EKr9ka8yZrgGayLpbng5s6n96

    Score
    10/10
    emotetepoch4bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral8

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

9
T1012

System Information Discovery

10
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks