Analysis
-
max time kernel
137s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
26-04-2024 18:59
Static task
static1
Behavioral task
behavioral1
Sample
017182c751a057b27cc19f470143c6ce_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
017182c751a057b27cc19f470143c6ce_JaffaCakes118.exe
-
Size
667KB
-
MD5
017182c751a057b27cc19f470143c6ce
-
SHA1
99d6a1a067463cc81c491546d48007cf5e60fadd
-
SHA256
896e51408c85cf449bf7cc28d7d6e3a52cf90da2ec15b59ee4ebd591cf57a259
-
SHA512
96bc973244a83f6d826be5750e487ef517a893ae113c688ef51f2a2ecac3c53abf9c3a520e33cafcafd43c3d28f9ee8ce54ef54130e554a6c802d6876549b788
-
SSDEEP
12288:U2JhG//t8C5VCFSoDpaQlHfl6mCiWDaBMFCZoCGsq:U2JC/t8iVNoDgQVN6mCiptsX
Malware Config
Extracted
emotet
Epoch3
116.91.240.96:80
167.71.227.113:8080
190.85.46.52:7080
162.144.42.60:8080
202.166.170.43:80
95.216.205.155:8080
120.51.34.254:80
103.93.220.182:80
111.89.241.139:80
60.125.114.64:443
45.177.120.37:8080
185.86.148.68:443
75.127.14.170:8080
119.92.77.17:80
203.153.216.178:7080
172.96.190.154:8080
179.5.118.12:80
153.229.219.1:443
139.59.12.63:8080
115.79.195.246:80
103.229.73.17:8080
195.201.56.70:8080
190.192.39.136:80
183.77.227.38:80
45.239.204.100:80
192.163.221.191:8080
46.32.229.152:8080
73.55.128.120:80
113.203.238.130:80
138.201.45.2:8080
180.148.4.130:8080
77.74.78.80:443
115.79.59.157:80
91.83.93.103:443
181.80.129.181:80
41.185.29.128:8080
178.33.167.120:8080
185.208.226.142:8080
91.75.75.46:80
86.57.216.23:80
143.95.101.72:8080
118.33.121.37:80
116.202.10.123:8080
103.80.51.61:8080
54.38.143.245:8080
50.116.78.109:8080
128.106.187.110:80
139.59.61.215:443
190.191.171.72:80
58.27.215.3:8080
223.17.215.76:80
37.205.9.252:7080
37.46.129.215:8080
46.105.131.68:8080
192.241.220.183:8080
24.231.51.190:80
113.161.148.81:80
109.206.139.119:80
118.243.83.70:80
185.142.236.163:443
172.105.78.244:8080
185.80.172.199:80
190.194.12.132:80
36.91.44.183:80
200.116.93.61:80
192.210.217.94:8080
93.20.157.143:80
198.57.203.63:8080
78.186.65.230:80
175.103.38.146:80
115.135.158.13:80
113.160.248.110:80
88.247.58.26:80
157.7.164.178:8081
67.121.104.51:20
74.208.173.91:8080
113.156.82.32:80
51.38.201.19:7080
14.241.182.160:80
79.133.6.236:8080
169.1.211.133:80
202.153.220.157:80
8.4.9.137:8080
220.106.127.191:443
5.79.70.250:8080
37.187.100.220:7080
113.193.239.51:443
Signatures
-
resource yara_rule behavioral2/memory/2252-0-0x00000000020E0000-0x00000000020F2000-memory.dmp emotet behavioral2/memory/2252-5-0x0000000002100000-0x0000000002110000-memory.dmp emotet behavioral2/memory/2252-7-0x00000000020C0000-0x00000000020CF000-memory.dmp emotet behavioral2/memory/3196-14-0x0000000000640000-0x0000000000650000-memory.dmp emotet behavioral2/memory/3196-10-0x0000000001FF0000-0x0000000002002000-memory.dmp emotet -
Executes dropped EXE 1 IoCs
pid Process 3196 ndfhcdiscovery.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\imagehlp\ndfhcdiscovery.exe 017182c751a057b27cc19f470143c6ce_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3196 ndfhcdiscovery.exe 3196 ndfhcdiscovery.exe 3196 ndfhcdiscovery.exe 3196 ndfhcdiscovery.exe 3196 ndfhcdiscovery.exe 3196 ndfhcdiscovery.exe 3196 ndfhcdiscovery.exe 3196 ndfhcdiscovery.exe 3196 ndfhcdiscovery.exe 3196 ndfhcdiscovery.exe 3196 ndfhcdiscovery.exe 3196 ndfhcdiscovery.exe 3196 ndfhcdiscovery.exe 3196 ndfhcdiscovery.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2252 017182c751a057b27cc19f470143c6ce_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2252 wrote to memory of 3196 2252 017182c751a057b27cc19f470143c6ce_JaffaCakes118.exe 83 PID 2252 wrote to memory of 3196 2252 017182c751a057b27cc19f470143c6ce_JaffaCakes118.exe 83 PID 2252 wrote to memory of 3196 2252 017182c751a057b27cc19f470143c6ce_JaffaCakes118.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\017182c751a057b27cc19f470143c6ce_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\017182c751a057b27cc19f470143c6ce_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\imagehlp\ndfhcdiscovery.exe"C:\Windows\SysWOW64\imagehlp\ndfhcdiscovery.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3196
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
667KB
MD5017182c751a057b27cc19f470143c6ce
SHA199d6a1a067463cc81c491546d48007cf5e60fadd
SHA256896e51408c85cf449bf7cc28d7d6e3a52cf90da2ec15b59ee4ebd591cf57a259
SHA51296bc973244a83f6d826be5750e487ef517a893ae113c688ef51f2a2ecac3c53abf9c3a520e33cafcafd43c3d28f9ee8ce54ef54130e554a6c802d6876549b788