General

  • Target

    85d13da8add48e43e7cbd98bd3156a3aae9e71b027768dd4ffb6a96cf687baf0

  • Size

    250KB

  • Sample

    200114-pamk676lrj

  • MD5

    be8caee192e38617e396e99b516899fc

  • SHA1

    168e4415feebc6b9fa9ca90db1babee4969902b4

  • SHA256

    85d13da8add48e43e7cbd98bd3156a3aae9e71b027768dd4ffb6a96cf687baf0

  • SHA512

    2d6530c523c3c2b624d24f5acfab4a99bcc912f93254c595f34d610a512768fe832769b5e82eff30bb73ac1e1af14f4fca71215c51c03993dc58508a3eed9c5b

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://xmdivas.com/a9981b580e0fef550bcb0fd8fadcc02b/eiqgv/

exe.dropper

http://digitaltimbangan.com/cgi-bin/cj8/

exe.dropper

https://sports.tj/wp-includes/p5n5i1d/

exe.dropper

https://work4sales.com/wp-content/rw5N8k08Ed/

exe.dropper

https://rmntnk.ru/omlakdj17fkcjfsd/rxm1/

Extracted

Family

emotet

Botnet

Epoch2

C2

66.7.242.50:8080

72.186.137.156:80

197.89.27.26:8080

91.250.96.22:8080

37.187.72.193:8080

104.131.44.150:8080

167.71.10.37:8080

78.24.219.147:8080

159.65.25.128:8080

95.128.43.213:8080

179.13.185.19:80

186.86.247.171:443

110.142.38.16:80

201.173.217.124:443

169.239.182.217:8080

211.63.71.72:8080

104.131.11.150:8080

190.55.181.54:443

209.146.22.34:443

64.53.242.181:8080

rsa_pubkey.plain

Targets

    • Target

      85d13da8add48e43e7cbd98bd3156a3aae9e71b027768dd4ffb6a96cf687baf0

    • Size

      250KB

    • MD5

      be8caee192e38617e396e99b516899fc

    • SHA1

      168e4415feebc6b9fa9ca90db1babee4969902b4

    • SHA256

      85d13da8add48e43e7cbd98bd3156a3aae9e71b027768dd4ffb6a96cf687baf0

    • SHA512

      2d6530c523c3c2b624d24f5acfab4a99bcc912f93254c595f34d610a512768fe832769b5e82eff30bb73ac1e1af14f4fca71215c51c03993dc58508a3eed9c5b

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails

    • Process spawned unexpected child process

    • Executes dropped EXE

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Tasks