Overview

overview

10

Static

static

3

7fb681d887...0N.exe

windows7-x64

10

7fb681d887...0N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7fb681d887d42ee92070e3e6cb21f010N.exe

  • Size

    304KB

  • Sample

    240906-zn2dcsxfpg

  • MD5

    7fb681d887d42ee92070e3e6cb21f010

  • SHA1

    af233d35a10a5e476789268464ed33840062a0ff

  • SHA256

    c8057609bb003a4aa4821a5413d0e87bcd5a51cdb8cdaa1858569cc9feba4718

  • SHA512

    bc9980ab883ba2a4416c45831ff6699c36950021b5a7b5742544d24e2cc31e7140f298c66a053574446d0823f87530be0cc0a86d407e70b040d1c055f09fe932

  • SSDEEP

    6144:EffinDToTm2cBd7ujJzt5eBMrpNDHssrzSn8RIazDF:T2cBd7+t5IsrzwqDF

Score
10/10
emotetepoch1bankerdiscoverytrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

58.171.153.81:80

104.131.103.128:443

66.228.49.173:8080

181.120.79.227:80

82.76.111.249:443

177.66.190.130:80

114.109.179.60:80

190.147.137.153:443

70.32.84.74:8080

104.131.103.37:8080

111.67.12.221:8080

177.74.228.34:80

217.13.106.14:8080

187.162.248.237:80

170.81.48.2:80

186.70.127.199:8090

104.236.161.64:8080

12.162.84.2:8080

177.73.0.98:443

191.182.6.118:80
rsa_pubkey.plain

Targets

    • Target

      7fb681d887d42ee92070e3e6cb21f010N.exe

    • Size

      304KB

    • MD5

      7fb681d887d42ee92070e3e6cb21f010

    • SHA1

      af233d35a10a5e476789268464ed33840062a0ff

    • SHA256

      c8057609bb003a4aa4821a5413d0e87bcd5a51cdb8cdaa1858569cc9feba4718

    • SHA512

      bc9980ab883ba2a4416c45831ff6699c36950021b5a7b5742544d24e2cc31e7140f298c66a053574446d0823f87530be0cc0a86d407e70b040d1c055f09fe932

    • SSDEEP

      6144:EffinDToTm2cBd7ujJzt5eBMrpNDHssrzSn8RIazDF:T2cBd7+t5IsrzwqDF

    Score
    10/10
    emotetepoch1bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet payload

      Detects Emotet payload in memory.

      trojanbanker

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks