Overview

overview

10

Static

static

3

f6a8c8f8f7...0N.exe

windows7-x64

10

f6a8c8f8f7...0N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f6a8c8f8f7695dcf2d1e2010c10fe5b0N.exe

  • Size

    1.1MB

  • Sample

    240907-ntqchasekl

  • MD5

    f6a8c8f8f7695dcf2d1e2010c10fe5b0

  • SHA1

    f8258d1962d06814bc1af084118cea745813ff1e

  • SHA256

    e3a212f22c1e1bd5caccc3428fdab7e66d2dca43b4e2235dba26b9b0f166cdc2

  • SHA512

    7749d539e2dd19af4cb35eac97eafd4a9f88024c5a88839f8269e711f8b3dac81f2c2e7fe246054810e1ac05016926881bf5031046453217e6b8abbbbd5fd366

  • SSDEEP

    24576:sTr5SZIyWWWWWWWvmgWzOvzZtfZrxRdbDME:sTr52IKgWzOvPfZtbP

Score
10/10
emotetepoch3bankerdiscoverytrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

118.110.236.121:8080

149.202.5.139:443

153.92.4.96:8080

51.75.163.68:7080

105.209.235.113:8080

77.74.78.80:443

51.38.201.19:7080

71.57.180.213:80

139.59.12.63:8080

185.86.148.68:443

179.62.238.49:80

58.27.215.3:8080

81.214.253.80:443

46.32.229.152:8080

197.221.158.162:80

81.17.93.134:80

118.101.24.148:80

86.98.143.163:80

46.105.131.68:8080

24.26.151.3:80
rsa_pubkey.plain

Targets

    • Target

      f6a8c8f8f7695dcf2d1e2010c10fe5b0N.exe

    • Size

      1.1MB

    • MD5

      f6a8c8f8f7695dcf2d1e2010c10fe5b0

    • SHA1

      f8258d1962d06814bc1af084118cea745813ff1e

    • SHA256

      e3a212f22c1e1bd5caccc3428fdab7e66d2dca43b4e2235dba26b9b0f166cdc2

    • SHA512

      7749d539e2dd19af4cb35eac97eafd4a9f88024c5a88839f8269e711f8b3dac81f2c2e7fe246054810e1ac05016926881bf5031046453217e6b8abbbbd5fd366

    • SSDEEP

      24576:sTr5SZIyWWWWWWWvmgWzOvzZtfZrxRdbDME:sTr52IKgWzOvPfZtbP

    Score
    10/10
    emotetepoch3bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks