General

  • Target

    3620f20bfa97132b42ea1af5bc739368177518a44f8194110319479bf5d255d6

  • Size

    165KB

  • Sample

    191212-xqezsft79s

  • MD5

    615e627ea2abdb1b85a0b79ac62af27a

  • SHA1

    b03ff6a8c6c12c9eb042ac91dd209abb14a831f4

  • SHA256

    3620f20bfa97132b42ea1af5bc739368177518a44f8194110319479bf5d255d6

  • SHA512

    74bd39013f1bdba041ce5348e8334ae4f96620086897886bf7d279b4f3103ecb41b5390fde561ebec79a14b214e1776a4e5552d8352e7e8ba742f75f18dd21cc

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://acqua.solarcytec.com/rtsbgs/XiWmtYYur/

exe.dropper

https://blog.learncy.net/wp-admin/user/oxZqQp/

exe.dropper

http://hospitalsanrafael.ainimedina.com/wp-includes/vwf-i8ge-4445917/

exe.dropper

https://sg771.kwikfunnels.com/phpmyadmin_bck/x9tfn-lv1h4-174129596/

exe.dropper

http://www.siyinjichangjia.com/wp-content/WYszsP/

Extracted

Family

emotet

Botnet

Epoch3

C2

190.146.14.143:443

85.235.219.74:80

78.187.204.70:80

46.105.128.215:8080

69.30.205.162:7080

192.161.190.171:8080

163.172.97.112:8080

86.98.157.3:80

113.52.135.33:7080

175.127.140.68:80

212.129.14.27:8080

200.41.121.69:443

143.95.101.72:8080

190.161.67.63:80

50.116.78.109:8080

37.46.129.215:8080

119.57.36.54:8080

212.112.113.235:80

46.105.131.68:8080

1.32.54.12:8080

rsa_pubkey.plain

Targets

    • Target

      3620f20bfa97132b42ea1af5bc739368177518a44f8194110319479bf5d255d6

    • Size

      165KB

    • MD5

      615e627ea2abdb1b85a0b79ac62af27a

    • SHA1

      b03ff6a8c6c12c9eb042ac91dd209abb14a831f4

    • SHA256

      3620f20bfa97132b42ea1af5bc739368177518a44f8194110319479bf5d255d6

    • SHA512

      74bd39013f1bdba041ce5348e8334ae4f96620086897886bf7d279b4f3103ecb41b5390fde561ebec79a14b214e1776a4e5552d8352e7e8ba742f75f18dd21cc

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails

    • Executes dropped EXE

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Tasks