General

  • Target

    1cd57050ed9c6654ffe89a96596dbf4e295b1ee3ec00609ef682adf6fba8601f.zip

  • Size

    73KB

  • Sample

    231013-rmjsxsad6s

  • MD5

    013ce8cb66c4079b2d7a152ca0e569d6

  • SHA1

    a6211d3debac2acca02a8c09e70b9d6bc4ba9c4d

  • SHA256

    36dcf0c47048c842ac26e9eed1973a54c739c7060da9039b53a119f412bcf6f2

  • SHA512

    f7c4f90bb49ae90c57c25cc6d5a1bcc69519dd7f562b61b1932bd36127965a9ba4d71b296d1a761b19d4d10b55a4b41341e389803ff8c4b504b4a2c88ac93ef3

  • SSDEEP

    1536:hXi4PEDZKAbLdkKqhRukR4m0P/myIiEGlRmRzZt:tbPcsAVlqnP4ZHmyDlRG

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

125.0.215.60:80

163.53.204.180:443

89.163.210.141:8080

203.157.152.9:7080

157.245.145.87:443

82.78.179.117:443

85.247.144.202:80

37.46.129.215:8080

110.37.224.243:80

192.210.217.94:8080

2.82.75.215:80

69.159.11.38:443

188.166.220.180:7080

103.93.220.182:80

198.20.228.9:8080

91.75.75.46:80

88.247.30.64:80

189.211.214.19:443

203.160.167.243:80

178.33.167.120:8080

rsa_pubkey.plain

Targets

    • Target

      1cd57050ed9c6654ffe89a96596dbf4e295b1ee3ec00609ef682adf6fba8601f.dll

    • Size

      117KB

    • MD5

      3464d1af70e8ff74525e87c6cebd0e6d

    • SHA1

      f6df5ab3d5a064ecce91e1e0ae39821f346ff53a

    • SHA256

      1cd57050ed9c6654ffe89a96596dbf4e295b1ee3ec00609ef682adf6fba8601f

    • SHA512

      b805bd05e9bf204636df7e7430381e04ffbfb04e74165622a71428cb6cf3ede45d84bdfd870c515fa73067a2651c32c80b3ffdcf0820aa98be9b7f56534584fe

    • SSDEEP

      1536:WuYPPzq3ZTRgSOrPTjy8sRgXhSJufpUL/P9jl00Ieoll/l6x3I4PipaMPtlVI3ui:WtPPusjfjy8suUlpAv0x+76+v8T5XDH

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks