Analysis
-
max time kernel
138s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
26-04-2024 16:32
Static task
static1
Behavioral task
behavioral1
Sample
0131019b0d949a4d3cb20951b94c8224_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
0131019b0d949a4d3cb20951b94c8224_JaffaCakes118.exe
-
Size
672KB
-
MD5
0131019b0d949a4d3cb20951b94c8224
-
SHA1
701ed42208f40761d355b0aa976abdcc77a1eff5
-
SHA256
c525b1bd1da2f3cccfcd636d3147a237716a418d161c95686dbd0aa28f03635d
-
SHA512
99533b2075da8dffc132837a379f0a38336191b8bffb8d64be5a1204bbf91c5d5a44d8a43ab364cd9b79c35a4a37e749eb6fb1113e55c0a677406f644bbd0564
-
SSDEEP
6144:PtEkXzqXV4beq+3nzgmF3JhpolOrJ5YcEKM5fkLaMiLgLWL7SqaaYo5wzPLNQOIG:PtZb03nzgU3yOrnYt6zEPdAH4c
Malware Config
Extracted
emotet
Epoch3
116.91.240.96:80
167.71.227.113:8080
190.85.46.52:7080
162.144.42.60:8080
202.166.170.43:80
95.216.205.155:8080
120.51.34.254:80
103.93.220.182:80
111.89.241.139:80
60.125.114.64:443
45.177.120.37:8080
185.86.148.68:443
75.127.14.170:8080
119.92.77.17:80
203.153.216.178:7080
172.96.190.154:8080
179.5.118.12:80
153.229.219.1:443
139.59.12.63:8080
115.79.195.246:80
103.229.73.17:8080
195.201.56.70:8080
190.192.39.136:80
183.77.227.38:80
45.239.204.100:80
192.163.221.191:8080
46.32.229.152:8080
73.55.128.120:80
113.203.238.130:80
138.201.45.2:8080
180.148.4.130:8080
77.74.78.80:443
115.79.59.157:80
91.83.93.103:443
181.80.129.181:80
41.185.29.128:8080
178.33.167.120:8080
185.208.226.142:8080
91.75.75.46:80
86.57.216.23:80
143.95.101.72:8080
118.33.121.37:80
116.202.10.123:8080
103.80.51.61:8080
54.38.143.245:8080
50.116.78.109:8080
128.106.187.110:80
139.59.61.215:443
190.191.171.72:80
58.27.215.3:8080
223.17.215.76:80
37.205.9.252:7080
37.46.129.215:8080
46.105.131.68:8080
192.241.220.183:8080
24.231.51.190:80
113.161.148.81:80
109.206.139.119:80
118.243.83.70:80
185.142.236.163:443
172.105.78.244:8080
185.80.172.199:80
190.194.12.132:80
36.91.44.183:80
200.116.93.61:80
192.210.217.94:8080
93.20.157.143:80
198.57.203.63:8080
78.186.65.230:80
175.103.38.146:80
115.135.158.13:80
113.160.248.110:80
88.247.58.26:80
157.7.164.178:8081
67.121.104.51:20
74.208.173.91:8080
113.156.82.32:80
51.38.201.19:7080
14.241.182.160:80
79.133.6.236:8080
169.1.211.133:80
202.153.220.157:80
8.4.9.137:8080
220.106.127.191:443
5.79.70.250:8080
37.187.100.220:7080
113.193.239.51:443
Signatures
-
resource yara_rule behavioral2/memory/4268-4-0x00000000022F0000-0x0000000002300000-memory.dmp emotet behavioral2/memory/4268-7-0x0000000000800000-0x000000000080F000-memory.dmp emotet behavioral2/memory/4268-0-0x00000000022D0000-0x00000000022E2000-memory.dmp emotet behavioral2/memory/3936-14-0x0000000002110000-0x0000000002120000-memory.dmp emotet behavioral2/memory/3936-10-0x00000000020E0000-0x00000000020F2000-memory.dmp emotet -
Executes dropped EXE 1 IoCs
pid Process 3936 ndproxystub.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\imapi2fs\ndproxystub.exe 0131019b0d949a4d3cb20951b94c8224_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3936 ndproxystub.exe 3936 ndproxystub.exe 3936 ndproxystub.exe 3936 ndproxystub.exe 3936 ndproxystub.exe 3936 ndproxystub.exe 3936 ndproxystub.exe 3936 ndproxystub.exe 3936 ndproxystub.exe 3936 ndproxystub.exe 3936 ndproxystub.exe 3936 ndproxystub.exe 3936 ndproxystub.exe 3936 ndproxystub.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4268 0131019b0d949a4d3cb20951b94c8224_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4268 0131019b0d949a4d3cb20951b94c8224_JaffaCakes118.exe 3936 ndproxystub.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4268 wrote to memory of 3936 4268 0131019b0d949a4d3cb20951b94c8224_JaffaCakes118.exe 84 PID 4268 wrote to memory of 3936 4268 0131019b0d949a4d3cb20951b94c8224_JaffaCakes118.exe 84 PID 4268 wrote to memory of 3936 4268 0131019b0d949a4d3cb20951b94c8224_JaffaCakes118.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\0131019b0d949a4d3cb20951b94c8224_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0131019b0d949a4d3cb20951b94c8224_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\SysWOW64\imapi2fs\ndproxystub.exe"C:\Windows\SysWOW64\imapi2fs\ndproxystub.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
672KB
MD50131019b0d949a4d3cb20951b94c8224
SHA1701ed42208f40761d355b0aa976abdcc77a1eff5
SHA256c525b1bd1da2f3cccfcd636d3147a237716a418d161c95686dbd0aa28f03635d
SHA51299533b2075da8dffc132837a379f0a38336191b8bffb8d64be5a1204bbf91c5d5a44d8a43ab364cd9b79c35a4a37e749eb6fb1113e55c0a677406f644bbd0564