Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-04-2024 16:10
Static task
static1
Behavioral task
behavioral1
Sample
74875643f4aceb77195135355d2fda38_JaffaCakes118.dll
Resource
win7-20240221-en
General
-
Target
74875643f4aceb77195135355d2fda38_JaffaCakes118.dll
-
Size
438KB
-
MD5
74875643f4aceb77195135355d2fda38
-
SHA1
3b2451955033930be975f4a6373a6d3a7e7ace85
-
SHA256
de9a7530b7e7b60346f644db15365b7a19d4c35a6b0c6a54c0cde297e2ea5f9c
-
SHA512
c692a9afe2ce6aca58beaa726e076286ea2957ea71059b02349a921f382a072d05062fcfe2cb7099ed7b617b86055524f26de09c6d69813c8c89d5b69453877a
-
SSDEEP
12288:W40je21huDiqirIXREi+SoOJITmR6ObY/Yu5caiFKOMldIse1mSCQ:W4+x1MEiFjXR6+Y/MFlMcseISV
Malware Config
Extracted
emotet
Epoch3
189.34.18.252:8080
189.211.214.19:443
203.157.152.9:7080
157.245.145.87:443
195.159.28.244:8080
202.29.237.113:8080
203.56.191.129:8080
46.32.229.152:8080
103.229.72.197:8080
190.194.12.132:80
157.7.164.178:8081
117.2.139.117:443
183.91.3.63:80
177.254.134.180:80
24.245.65.66:80
223.17.215.76:80
27.78.27.110:443
46.105.131.68:8080
79.133.6.236:8080
58.27.215.3:8080
139.59.61.215:443
121.117.147.153:443
178.33.167.120:8080
110.37.224.243:80
177.130.51.198:80
69.159.11.38:443
178.254.36.182:8080
77.89.249.254:443
115.79.195.246:80
37.205.9.252:7080
2.58.16.86:8080
78.90.78.210:80
109.99.146.210:8080
114.158.126.84:80
172.193.14.201:80
139.59.12.63:8080
162.144.145.58:8080
103.80.51.61:8080
195.201.56.70:8080
120.51.34.254:80
192.241.220.183:8080
5.79.70.250:8080
103.93.220.182:80
5.83.32.101:80
175.103.38.146:80
37.46.129.215:8080
178.62.254.156:8080
91.75.75.46:80
103.124.152.221:80
201.212.201.127:8080
116.202.10.123:8080
186.146.229.172:80
182.73.7.59:8080
192.163.221.191:8080
180.148.4.130:8080
190.18.184.113:80
47.150.238.196:80
50.116.78.109:8080
198.20.228.9:8080
188.166.220.180:7080
188.226.165.170:8080
192.210.217.94:8080
8.4.9.137:8080
186.96.170.61:80
152.32.75.74:443
190.85.46.52:7080
172.104.46.84:8080
73.55.128.120:80
163.53.204.180:443
110.172.180.180:8080
172.96.190.154:8080
203.153.216.178:7080
85.247.144.202:80
203.160.167.243:80
185.142.236.163:443
82.78.179.117:443
143.95.101.72:8080
185.208.226.142:8080
113.203.238.130:80
91.83.93.103:443
2.82.75.215:80
54.38.143.245:8080
24.230.124.78:80
70.32.89.105:8080
75.127.14.170:8080
74.208.173.91:8080
139.5.101.203:80
103.229.73.17:8080
60.108.128.186:80
Signatures
-
Blocklisted process makes network request 6 IoCs
flow pid Process 3 1444 rundll32.exe 5 1444 rundll32.exe 6 1444 rundll32.exe 7 1444 rundll32.exe 8 1444 rundll32.exe 9 1444 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1444 rundll32.exe 1444 rundll32.exe 1444 rundll32.exe 1444 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2148 wrote to memory of 1444 2148 rundll32.exe 28 PID 2148 wrote to memory of 1444 2148 rundll32.exe 28 PID 2148 wrote to memory of 1444 2148 rundll32.exe 28 PID 2148 wrote to memory of 1444 2148 rundll32.exe 28 PID 2148 wrote to memory of 1444 2148 rundll32.exe 28 PID 2148 wrote to memory of 1444 2148 rundll32.exe 28 PID 2148 wrote to memory of 1444 2148 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74875643f4aceb77195135355d2fda38_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74875643f4aceb77195135355d2fda38_JaffaCakes118.dll,#12⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1444
-