General

  • Target

    1161e34b11701cd6940b573a20dc7610N.exe

  • Size

    840KB

  • Sample

    240905-ky3lvaxgne

  • MD5

    1161e34b11701cd6940b573a20dc7610

  • SHA1

    98f20bb39fe67aceba331d0ad1a97f5fc4465d2c

  • SHA256

    224724ebbf9e298b525a9223fa3fead8758ccb2fdc6fc1a6c69f49096479f4bb

  • SHA512

    14eca37d91380a89a1a08da32c82041b1c7aad6fa2c95c8f684cdd758c0dac973e80e850c10edf8bb4cb57bc4f93596176173d90966ce3433bbceba2d541513c

  • SSDEEP

    12288:whFdbbWYbWeVqXIl0tx8uX7pKgR0vT+LyYumu7qy36DINoKOfc3O:ijbWY/yLLwrT+LyYSmIdOfc

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

197.245.25.228:80

98.103.204.12:443

59.148.253.194:8080

173.212.197.71:8080

87.106.46.107:8080

50.28.51.143:8080

177.73.0.98:443

213.197.182.158:8080

185.94.252.12:80

189.223.16.99:80

5.189.178.202:8080

186.103.141.250:443

181.129.96.162:8080

190.101.156.139:80

46.105.114.137:8080

51.15.7.145:80

98.13.75.196:80

202.134.4.210:7080

104.131.41.185:8080

181.123.6.86:80

rsa_pubkey.plain

Targets

    • Target

      1161e34b11701cd6940b573a20dc7610N.exe

    • Size

      840KB

    • MD5

      1161e34b11701cd6940b573a20dc7610

    • SHA1

      98f20bb39fe67aceba331d0ad1a97f5fc4465d2c

    • SHA256

      224724ebbf9e298b525a9223fa3fead8758ccb2fdc6fc1a6c69f49096479f4bb

    • SHA512

      14eca37d91380a89a1a08da32c82041b1c7aad6fa2c95c8f684cdd758c0dac973e80e850c10edf8bb4cb57bc4f93596176173d90966ce3433bbceba2d541513c

    • SSDEEP

      12288:whFdbbWYbWeVqXIl0tx8uX7pKgR0vT+LyYumu7qy36DINoKOfc3O:ijbWY/yLLwrT+LyYSmIdOfc

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

    • Executes dropped EXE

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks