General

  • Target

    84a687f0aae02f7bccd094d781642764438ebe319d7c01055c9220b3ae517b8e

  • Size

    552KB

  • Sample

    191212-k7ef2nrbm2

  • MD5

    33b1707acf181695b7bd8fec4c0a5049

  • SHA1

    c6e5067fbecaff233f61c167ca2bc9877eebb56e

  • SHA256

    84a687f0aae02f7bccd094d781642764438ebe319d7c01055c9220b3ae517b8e

  • SHA512

    3faf074f94e9d5b549358a63ff7deac05fbc621f0e7c25136cdb16103e38a87e6d12fa33afa9dba7560424b182c33faa6b670de266a874c5d0cb6adb6fb9759c

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

91.74.175.46:80

96.38.234.10:80

71.76.45.83:443

96.126.121.64:443

104.236.137.72:8080

85.234.143.94:8080

80.85.87.122:8080

130.45.45.31:80

62.75.143.100:7080

142.93.114.137:8080

79.7.114.1:80

134.209.214.126:8080

68.183.190.199:8080

139.162.118.88:8080

212.71.237.140:8080

46.28.111.142:7080

181.231.62.54:80

200.124.225.32:80

73.167.135.180:80

200.119.11.118:443

rsa_pubkey.plain

Targets

    • Target

      84a687f0aae02f7bccd094d781642764438ebe319d7c01055c9220b3ae517b8e

    • Size

      552KB

    • MD5

      33b1707acf181695b7bd8fec4c0a5049

    • SHA1

      c6e5067fbecaff233f61c167ca2bc9877eebb56e

    • SHA256

      84a687f0aae02f7bccd094d781642764438ebe319d7c01055c9220b3ae517b8e

    • SHA512

      3faf074f94e9d5b549358a63ff7deac05fbc621f0e7c25136cdb16103e38a87e6d12fa33afa9dba7560424b182c33faa6b670de266a874c5d0cb6adb6fb9759c

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails

    • Windows security modification

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Tasks