Overview

overview

10

Static

static

3

E1-2020082...16.exe

windows7-x64

10

E1-2020082...16.exe

windows10-2004-x64

10

E1-2020082...15.exe

windows7-x64

10

E1-2020082...15.exe

windows10-2004-x64

10

E1-2020082...10.exe

windows7-x64

10

E1-2020082...10.exe

windows10-2004-x64

10

E1-2020082...27.exe

windows7-x64

10

E1-2020082...27.exe

windows10-2004-x64

10

E1-2020082...48.exe

windows7-x64

10

E1-2020082...48.exe

windows10-2004-x64

10

E1-2020082...10.exe

windows7-x64

10

E1-2020082...10.exe

windows10-2004-x64

10

E1-2020082...48.exe

windows7-x64

10

E1-2020082...48.exe

windows10-2004-x64

10

E2-2020082...28.exe

windows7-x64

10

E2-2020082...28.exe

windows10-2004-x64

10

E2-2020082...15.exe

windows7-x64

10

E2-2020082...15.exe

windows10-2004-x64

10

E2-2020082...02.exe

windows7-x64

10

E2-2020082...02.exe

windows10-2004-x64

10

E2-2020082...54.exe

windows7-x64

10

E2-2020082...54.exe

windows10-2004-x64

10

E2-2020082...48.exe

windows7-x64

10

E2-2020082...48.exe

windows10-2004-x64

10

E2-2020082...21.exe

windows7-x64

10

E2-2020082...21.exe

windows10-2004-x64

10

E3-2020082...31.exe

windows7-x64

10

E3-2020082...31.exe

windows10-2004-x64

10

E3-2020082...28.exe

windows7-x64

10

E3-2020082...28.exe

windows10-2004-x64

10

E3-2020082...56.exe

windows7-x64

10

E3-2020082...56.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    672d3e3a2dbecb8950cb8bd76c637fad98b59a3d27d1bf18fc327f40fa0948a3

  • Size

    3.4MB

  • Sample

    241121-ab4khswnav

  • MD5

    8862f4b885a14e6e26ef41275b3a1c6a

  • SHA1

    fd12187237ce850cd03aa86833e4862f6ec3a3e4

  • SHA256

    672d3e3a2dbecb8950cb8bd76c637fad98b59a3d27d1bf18fc327f40fa0948a3

  • SHA512

    8ad1cbfd9f4ceebc708ef4c89b12315f2fecccc2cdf9b54399b33632516c9a4f0a44693489d9845ad27336a52a7e631f8e53203d2bd21c636bc25b0a37175563

  • SSDEEP

    98304:gVEyf6j2u9tqiIDAQDqWzjTfI+4KCkeKkxt37W:gEG6j2Oqi4AQWWzvfIPKkxtLW

Score
10/10
emotetepoch1epoch2epoch3bankerdiscoverytrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

71.197.211.156:80

87.118.70.45:8080

91.121.54.71:8080

116.125.120.88:443

213.60.96.117:80

188.2.217.94:80

174.100.27.229:80

46.28.111.142:7080

186.103.141.250:443

207.144.103.227:80

110.142.219.51:80

70.32.84.74:8080

70.32.115.157:8080

111.67.12.221:8080

219.92.13.25:80

149.62.173.247:8080

177.72.13.80:80

77.238.212.227:80

5.196.35.138:7080

114.109.179.60:80
rsa_pubkey.plain

Extracted

Family

emotet

Botnet

Epoch2

C2

173.81.218.65:80

45.55.36.51:443

91.83.93.99:7080

45.55.219.163:443

169.239.182.217:8080

24.43.99.75:80

78.24.219.147:8080

95.179.229.244:8080

107.5.122.110:80

47.144.21.12:443

204.197.146.48:80

139.99.158.11:443

190.160.53.126:80

74.120.55.163:80

74.109.108.202:80

47.146.117.214:80

104.236.246.93:8080

174.137.65.18:80

41.60.200.34:80

209.141.54.221:8080
rsa_pubkey.plain

Extracted

Family

emotet

Botnet

Epoch3

C2

88.249.181.198:443

65.156.53.186:8080

68.183.233.80:8080

185.81.158.15:8080

37.187.100.220:7080

60.125.114.64:443

201.235.10.215:80

81.214.253.80:443

118.101.24.148:80

181.126.54.234:80

197.232.36.108:80

178.87.171.199:80

139.99.157.213:8080

115.79.195.246:80

177.94.227.143:80

113.161.148.81:80

192.210.217.94:8080

173.94.215.84:80

112.78.142.170:80

217.199.160.224:8080
rsa_pubkey.plain

Targets

    • Target

      E1-20200827_061516

    • Size

      412KB

    • MD5

      054cfae95ec070930410ae76a38479a3

    • SHA1

      da35bde84c40122582fd57d793b55f4062984822

    • SHA256

      43c5bfbdf4f6627e2fd6de75977daa2dbf48e5cf0b42c7d0ad2cd921549b84f6

    • SHA512

      8ff6467935aef47509622f9a169b6eaa71830fb7cf49613951376eff10353276f7196c163aad3c3ad75eeb3194bb4e94cb216002f8a2cc651998a3fb85949bc0

    • SSDEEP

      3072:GzoB+F9ah8tFGNhd5/2dGqHNLiFgpaO8072SBKUgMFuNtaNm/xwa0+uw:G8B+F9Nuhd56paJEZTVu/Y+

    Score
    10/10
    emotetepoch1bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet family

      emotet

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1behavioral2

    • Target

      E1-20200827_090915

    • Size

      704KB

    • MD5

      1e92c1d84c8132e9fbf1887d3903144a

    • SHA1

      0803d84972aaee54e629a7f09c7804aa6ea3b916

    • SHA256

      3c84b2d43034c6eea5bb00b9b84271eca6cb0dffe6d1c5faac32bea7095ef8da

    • SHA512

      07524b8a17c7c91779e0b7a2a07a84ab32a934d533415ccb96596b90ebd7113542a2f2b1ba080f6e3ed1b075241261604cdff816b5d99a7945fe378c546cc538

    • SSDEEP

      12288:SIlkcMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM+MMMMMMMMMMMMMMMMMMMMMMMMQ:SEkcMMMMMMMMMMMMMMMMMMMMMMMMMMMl

    Score
    10/10
    emotetepoch1bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet family

      emotet

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral3behavioral4

    • Target

      E1-20200827_095810

    • Size

      202KB

    • MD5

      a8117e700e265412085b4cc41ea5bd37

    • SHA1

      4f3646d9305d0c6b79f7dd50d00649a639eba8ce

    • SHA256

      94477836420ad52b170b6ca8f84bff105c42c5cc7d7fd433599771cac80b4029

    • SHA512

      9ba305f7501f60adc2608e1c52bb9638010d8297b8f84a4b842291854852454d76fe498194a05304326a8051004859b0260c274e421a4b80e03ebfdf4185ae92

    • SSDEEP

      3072:xOT444444444444444444444444444444444444444444444444444444444444E:4zjOQOjuoPR

    Score
    10/10
    emotetepoch1bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet family

      emotet

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral5behavioral6

    • Target

      E1-20200827_145627

    • Size

      656KB

    • MD5

      b550203dc7bfd69e9f93135540fc6b07

    • SHA1

      b456c0a370cc4c99d7a709c09f62c8602d202daf

    • SHA256

      ef75872ca98166b1d1d4099be8947f2a03c53fe8444a443097943d55352a2de0

    • SHA512

      f7539fba89aa5232518a90ff2a32be3cd10949d1a6130a0342626dad241fca01c01dede589dde8b5a51a817f9579c8318a344987db6a3141d5d45e00130d1aa3

    • SSDEEP

      6144:RZd3Z+AlMjixnmMsQSyzKdYkTGdvWh3/IiZqjOQOjuoP67GEGsG:RZBZZKimMsQSGH/dv0NqSPP6adV

    Score
    10/10
    emotetepoch1bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet family

      emotet

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral7behavioral8

    • Target

      E1-20200827_162348

    • Size

      536KB

    • MD5

      f18886e16f28aea70822fa78b37052e1

    • SHA1

      2e8743a09d5e3ec458e82cc3e7d351507c1337cb

    • SHA256

      cb783af6a11e0b00963375cdc2077ca48a7e6a5931643598c5490c8fc0432422

    • SHA512

      c7cfe49fc13faca66499475982b99e8fa014ca0db583e8106827998d7aa417b2bbb3eb8c8c0977c21541123dfac4b2777b062642323dd750b01c1cb62f7080d6

    • SSDEEP

      6144:L+a3QXAVvjF+MHy0wyqjOQOjuoP67GEGsGV:FgXAVhQ4qSPP6adVV

    Score
    10/10
    emotetepoch1bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet family

      emotet

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral10behavioral9

    • Target

      E1-20200827_163610

    • Size

      656KB

    • MD5

      ba0fe199698e8867edd89d3a25fd66b2

    • SHA1

      3b4c7150e92b03c6bd28b1ee4e97763516edca6f

    • SHA256

      d002bb7e19b0eaa63cb439a1402331d8eddebfe88d5d2609a7cb32d6b2ebaf82

    • SHA512

      6b02a9570733580575fa1cf10608f23f46117c92676ee2ef5307001508e537b528e3543a7f0e7cdf4f1f426d6ff251265ba8ffde241b9bb7c5a8a2d66d9e8f07

    • SSDEEP

      6144:8wHOMFgwTSWJ3pgxNUpEOiYsx2ieqjOQOjuoP67GEGsG:8mOMKJWJ3pUeqSPP6adV

    Score
    10/10
    emotetepoch1bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet family

      emotet

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral11behavioral12

    • Target

      E1-20200827_170748

    • Size

      468KB

    • MD5

      8b68758c3a05bcc20c7b6fc24b04e3fa

    • SHA1

      4fff82211a8d80f432ec1e7cde80750307f8df8f

    • SHA256

      0f97585806e971e7dcaafc5c323f35f071ee8b277237fab17ef321085ab0715c

    • SHA512

      c2c85897d4fc2fd978e46463f194d7cd37eb46f8e94dbd5b65542a966c178d9410f45b224b4150d2623e79579aee052bdf70832bda8e06fb325b4c297d7415ed

    • SSDEEP

      6144:Ba0lzIF1MpaYcN2PVgQfgfunByqVbuoMdVQtCiUUvX8HQHkd2LDEn+GfzO9+/S94:bEjMpaYk2PuUgfE7byrQtQYQ

    Score
    10/10
    emotetepoch1bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet family

      emotet

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral13behavioral14

    • Target

      E2-20200827_061428

    • Size

      412KB

    • MD5

      d877c44e3bb8450f4373c952c8940f09

    • SHA1

      1fc9a7f8e433b3723547d473dd5a85f4dbbb8f9c

    • SHA256

      69eb2fcf19e6b3fd975f41422f3609b3a23d6895ed29637ffc2327ef75a4cd30

    • SHA512

      d1d25fb276b8437c9ec79784cba030eb3dacc4824aa78c82c82ff1cf298147cb2d08e0acb109df3439ec98dbb163d491bd065a544c78e296578727d5a54ba58b

    • SSDEEP

      3072:WzoB+F9ah8tFGNhd5/2dGqHNLiFgpaO8072SBKUgMouNtaNv8ft+UhFZaexOAvvw:W8B+F9Nuhd56paJEZTMup8I+A

    Score
    10/10
    emotetepoch2bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet family

      emotet

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral15behavioral16

    • Target

      E2-20200827_090615

    • Size

      704KB

    • MD5

      358d17af2bc59fc7bc8776bb90563d55

    • SHA1

      d0581d6bce890cfc28f289b227b9e5f9c615b380

    • SHA256

      78e235ad1c7fa29da9ebe722d77ec3b67a5068af654957e88d90c502265c16dd

    • SHA512

      cfb35a8aa45c04722e9c29785c058b2f8e60ff76516e4b362a6a7ef79757c9a009e43ddddf00354b777fe20a62efcdd94cb019abb41a5b127dc359a700e9b0fa

    • SSDEEP

      12288:YIlkcMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM+MMMMMMMMMMMMMMMMMMMMMMMMV:YEkcMMMMMMMMMMMMMMMMMMMMMMMMMMMc

    Score
    10/10
    emotetepoch2bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet family

      emotet

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral17behavioral18

    • Target

      E2-20200827_145402

    • Size

      656KB

    • MD5

      bed7b299b813c252952b4186ee18e7ab

    • SHA1

      80334aa4ee7326535e6faa79111a6f12abbff6d9

    • SHA256

      e883042560db658b77dde018047e8932cb72e9dffd73318b30ffbc2f71389f0a

    • SHA512

      5d99c388a9427153a1f070f7c850619719fce2d666604f76899d0c6cb69f1765f540a2c1b2c3dcdfacc0cb7f8912b852e3a4e34a8e5b9125d32275b3dd9ebe64

    • SSDEEP

      6144:6Zd3Z+AlMjixnmMsQSyzKdYkTGdvWh39IiZpQrgiPPGEGsG:6ZBZZKimMsQSGH/dv0TpQrsdV

    Score
    10/10
    emotetepoch2bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet family

      emotet

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral19behavioral20

    • Target

      E2-20200827_162454

    • Size

      536KB

    • MD5

      214f09b2b5422a6d10bbcce21a38563b

    • SHA1

      514b6c5b42afe025e4e9d84e68f458ad63fc2272

    • SHA256

      1ba30417e69002ac0e8ac4ef643de661c6d90859bffce755e5bb46a5fb973bb8

    • SHA512

      7a6b5cf6878f5370d704084a8ff301fa7bdfa0543c2125dfda6fae21239ea8f69f0b6f39df64a6d80301b158af3d296a3122a3d0d747509c61878e7a9b394e36

    • SSDEEP

      3072:77xkm+aAsQnXBDXdAVvj/t+Ve94BEwVEwypQrgb2mi/Z9smMhv2TmTyTyTWsmMhr:J+a3QXAVvjF+MHwewypQrgiPPGEGsGn

    Score
    10/10
    emotetepoch2bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet family

      emotet

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral21behavioral22

    • Target

      E2-20200827_163448

    • Size

      656KB

    • MD5

      b6ce3ebc3dcf0d7aacb32c960d792f05

    • SHA1

      87cdca900fea8381bae02c3043f56b83ee43170d

    • SHA256

      6f49d0ce475b4241f1eb1529cbf3c04f1f0d667be553c55bda165ee48c46249b

    • SHA512

      87f0e3ab37b2c14426741e67e47d3ac5865972aa7ccf3bc90b7dd40dcdfbf0e520fd1d8bdaf46818bbc462c0e4db67fdd289e00cef14387895d164340ca082f6

    • SSDEEP

      6144:WwHOMFgwTSWJ3pgxNUpEOwYsx2iepQrgiPPGEGsG:WmOMKJWJ3p6epQrsdV

    Score
    10/10
    emotetepoch2bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet family

      emotet

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral23behavioral24

    • Target

      E2-20200827_170621

    • Size

      468KB

    • MD5

      4f136a9e2f9fba2574de04959eedc12a

    • SHA1

      379ef8b083a81f9f39c483b7e5401adbfcc1d376

    • SHA256

      594a9b230b48f81316bfc3963d949e9385d0f2d25f567f5e78eaa2b4eeb15686

    • SHA512

      bed021a27425f9b79e39d71a610c66f738f37762d2b3759baae42fb0cc4bad6c39c3b48320bf73b36f1317b5befa52a2c742e0e4a02220872bb0934c8f99281c

    • SSDEEP

      6144:ka0lzIF1MpaYcN2PVgQfgfunByqVbuoMdVZBfiUUvX8HQHkd2LDEn+GfzO9+/S97:EEjMpaYk2PuUgfE7byrZB1SR

    Score
    10/10
    emotetepoch2bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet family

      emotet

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral25behavioral26

    • Target

      E3-20200827_061531

    • Size

      412KB

    • MD5

      a2df421b99f9854f75e68e8c3d8476a3

    • SHA1

      bbfc4bba21022043d50e47f56635f8122704aee7

    • SHA256

      529cac7f42d829cfba9ff7ff39e053717247bae222879ef4f54af2165d020119

    • SHA512

      bd517ca96eb4f9c420dc4079ff03f4cb1bb2778c928bd455fe52c757ebbbcf2f9712383d55316a472931d43c5f926a892ec3eddc62e58370be59ba5906f7d7c4

    • SSDEEP

      3072:nzoB+F9ah8tFGNhd5/2dGqHNLiFgpaO8072SBKUgTtuNtiDrUYNA0YFH8w:n8B+F9Nuhd56paJEZTcu3QA0Y

    Score
    10/10
    emotetepoch3bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet family

      emotet

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral27behavioral28

    • Target

      E3-20200827_090928

    • Size

      704KB

    • MD5

      66207dfc1a312b6b4bef4423d0bedf08

    • SHA1

      9b2e50f42d0f414596258ff712e7a9b8a5f556a5

    • SHA256

      c58af7df06b15140d8d4b76bd587e20b2c25d52b45e8099f6487e62fc844901e

    • SHA512

      104a513426822d314f7539429bc3fcfe737a46182370e12c832435edb48d9eae9ce7d401503f2bdfea715a408f51bd2e712db27f3e6e5f4d08a803eb8b5fbf6e

    • SSDEEP

      12288:BIlkcMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM+MMMMMMMMMMMMMMMMMMMMMMMM7:BEkcMMMMMMMMMMMMMMMMMMMMMMMMMMMU

    Score
    10/10
    emotetepoch3bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet family

      emotet

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral29behavioral30

    • Target

      E3-20200827_145656

    • Size

      660KB

    • MD5

      a8b8675b57545f8f3bab0b000d4b65ef

    • SHA1

      98af039a6a1d3faaeb4cb1ffed43d720c62b1aa9

    • SHA256

      66ad54e3a1a266fd12cda27eeb9830b1e084548a90693ff11ad4e5498352e9ef

    • SHA512

      bd9e899fe74168e1890e2b7554b2241b0c7a191908f58a9e004f36acc62979d93aae051abab27a4944ee5cd86ed491f57b6ffed9aed4559e1d6d9ac34028a0e6

    • SSDEEP

      6144:EZd3Z+AlMjixnmMsQSyzKdYkTGdvWh3+IiEwkyEQGEGsG:EZBZZKimMsQSGH/dv0DwFydV

    Score
    10/10
    emotetepoch3bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet family

      emotet

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

emotetepoch1bankerdiscoverytrojan
Score
10/10

behavioral2

emotetepoch1bankerdiscoverytrojan
Score
10/10

behavioral3

emotetepoch1bankerdiscoverytrojan
Score
10/10

behavioral4

emotetepoch1bankerdiscoverytrojan
Score
10/10

behavioral5

emotetepoch1bankerdiscoverytrojan
Score
10/10

behavioral6

emotetepoch1bankerdiscoverytrojan
Score
10/10

behavioral7

emotetepoch1bankerdiscoverytrojan
Score
10/10

behavioral8

emotetepoch1bankerdiscoverytrojan
Score
10/10

behavioral9

emotetepoch1bankerdiscoverytrojan
Score
10/10

behavioral10

emotetepoch1bankerdiscoverytrojan
Score
10/10

behavioral11

emotetepoch1bankerdiscoverytrojan
Score
10/10

behavioral12

emotetepoch1bankerdiscoverytrojan
Score
10/10

behavioral13

emotetepoch1bankerdiscoverytrojan
Score
10/10

behavioral14

emotetepoch1bankerdiscoverytrojan
Score
10/10

behavioral15

emotetepoch2bankerdiscoverytrojan
Score
10/10

behavioral16

emotetepoch2bankerdiscoverytrojan
Score
10/10

behavioral17

emotetepoch2bankerdiscoverytrojan
Score
10/10

behavioral18

emotetepoch2bankerdiscoverytrojan
Score
10/10

behavioral19

emotetepoch2bankerdiscoverytrojan
Score
10/10

behavioral20

emotetepoch2bankerdiscoverytrojan
Score
10/10

behavioral21

emotetepoch2bankerdiscoverytrojan
Score
10/10

behavioral22

emotetepoch2bankerdiscoverytrojan
Score
10/10

behavioral23

emotetepoch2bankerdiscoverytrojan
Score
10/10

behavioral24

emotetepoch2bankerdiscoverytrojan
Score
10/10

behavioral25

emotetepoch2bankerdiscoverytrojan
Score
10/10

behavioral26

emotetepoch2bankerdiscoverytrojan
Score
10/10

behavioral27

emotetepoch3bankerdiscoverytrojan
Score
10/10

behavioral28

emotetepoch3bankerdiscoverytrojan
Score
10/10

behavioral29

emotetepoch3bankerdiscoverytrojan
Score
10/10

behavioral30

emotetepoch3bankerdiscoverytrojan
Score
10/10

behavioral31

emotetepoch3bankerdiscoverytrojan
Score
10/10

behavioral32

emotetepoch3bankerdiscoverytrojan
Score
10/10