Overview

overview

10

Static

static

3

584d18ef44...19.dll

windows7-x64

10

584d18ef44...19.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    584d18ef44af9d254d115ab93d5bb516dab54cc354119c817190aef79fd25119.dll

  • Size

    271KB

  • Sample

    240726-dv62jawglf

  • MD5

    94b4cfed4e0711886ef2adaab00c7098

  • SHA1

    af3685f08a6e056d635395edc9f7f21efadfbbf9

  • SHA256

    584d18ef44af9d254d115ab93d5bb516dab54cc354119c817190aef79fd25119

  • SHA512

    5b52c934927c3f4609fdc6faab476093adc609241f0384c9e0de21e13401dafb5b57c0e7b8751a695d806a5a90a6214d81d2dcc311553e7a5b3effd6b90672c2

  • SSDEEP

    6144:+60EDP6uCLfGw/GpxXinM1BCo1PlumGx2mx2tXd0t115JGy:X5DpBw/KViMTB1MnEWk0115JF

Score
10/10
emotetepoch1bankerdiscoverytrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

200.75.39.254:80

201.185.69.28:443

206.189.232.2:8080

138.197.99.250:8080

167.71.148.58:443

190.45.24.210:80

110.39.162.2:443

201.75.62.86:80

46.105.114.137:8080

190.247.139.101:80

59.148.253.194:8080

137.74.106.111:7080

202.79.24.136:443

177.85.167.10:80

80.15.100.37:80

45.16.226.117:443

190.24.243.186:80

138.97.60.141:7080

2.80.112.146:80

81.214.253.80:443
rsa_pubkey.plain

Targets

    • Target

      584d18ef44af9d254d115ab93d5bb516dab54cc354119c817190aef79fd25119.dll

    • Size

      271KB

    • MD5

      94b4cfed4e0711886ef2adaab00c7098

    • SHA1

      af3685f08a6e056d635395edc9f7f21efadfbbf9

    • SHA256

      584d18ef44af9d254d115ab93d5bb516dab54cc354119c817190aef79fd25119

    • SHA512

      5b52c934927c3f4609fdc6faab476093adc609241f0384c9e0de21e13401dafb5b57c0e7b8751a695d806a5a90a6214d81d2dcc311553e7a5b3effd6b90672c2

    • SSDEEP

      6144:+60EDP6uCLfGw/GpxXinM1BCo1PlumGx2mx2tXd0t115JGy:X5DpBw/KViMTB1MnEWk0115JF

    Score
    10/10
    emotetepoch1bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks