General

  • Target

    bf274f8c9ba0a2e9b51cc341688a1bc827e21e3d52f152bf49380123f70b2a59.zip

  • Size

    153KB

  • Sample

    231013-r1d5laad8x

  • MD5

    86db29dd242e3f06237ba5468d414660

  • SHA1

    eadf157a49e5956c90a3ef79d1a53559c5a3364f

  • SHA256

    6fb0120dd9999a02512e38ab0b55d440250221b68f941cf9c07e178bad49cf85

  • SHA512

    bfbaefb6b40224ef86dea652857ca6a26edbae50f0c5b6c2a2af68bacdbd10ffd27bef5e909addfbbf37b25680c2a9958917853174c30559c54fc97a2b8ef2f6

  • SSDEEP

    3072:yzFmt4LyVhZWfbGkiUSGS8utxID3k7m4fWrfBIbDmBQ7eyV3GvWQhhM+JgDzpqQ:aFm6LahguUSGS8Ylm2WrZ87NV0WuhpJ0

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

125.0.215.60:80

163.53.204.180:443

89.163.210.141:8080

203.157.152.9:7080

157.245.145.87:443

82.78.179.117:443

85.247.144.202:80

37.46.129.215:8080

110.37.224.243:80

192.210.217.94:8080

2.82.75.215:80

69.159.11.38:443

188.166.220.180:7080

103.93.220.182:80

198.20.228.9:8080

91.75.75.46:80

88.247.30.64:80

189.211.214.19:443

203.160.167.243:80

178.33.167.120:8080

rsa_pubkey.plain

Targets

    • Target

      bf274f8c9ba0a2e9b51cc341688a1bc827e21e3d52f152bf49380123f70b2a59.dll

    • Size

      197KB

    • MD5

      19b0124f2e4f223113bb11a84765a6c3

    • SHA1

      d27bfe2481c74fe0c213456ad3906e96097ab4c6

    • SHA256

      bf274f8c9ba0a2e9b51cc341688a1bc827e21e3d52f152bf49380123f70b2a59

    • SHA512

      c9bd86474c8500d948d7c1af660f60af00cffee8f6525785ad916a669c87386ad23c5955dc8e2dbe666cbdc57b46c4d1e813ced09a61920aeb4f17bc520cd602

    • SSDEEP

      3072:7zrlNwFBuQ+i2ro9Ux4huw/mY2EeTyDcqsAX8QaCQ5IS39mLSnwKl:7zPkBvoroGIRe+7sAXMCQL3ImwK

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks