Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
27-04-2024 12:42
General
-
Target
03463167e46b424f19b8c5b7ab0a5702_JaffaCakes118.exe
-
Size
446KB
-
MD5
03463167e46b424f19b8c5b7ab0a5702
-
SHA1
8c4eaeb9b0c95642e081f33f81447d91af05f440
-
SHA256
613f1ea1af0bc834d0e109cbce78ca8950a01fbce60b07cb97c746fdf2b48aac
-
SHA512
d3fa372b46b9eca7cf79fe0890fb1543c6c0ee1c805d9140bca8f853c91ea30acd89533d7a384691fc73810977b7d33eff560487f27ac5e3c4d0181704e9a5bc
-
SSDEEP
6144:NwekW4xuXsbOrpq6tQvq6H/iawC7MLSnyZtC:NwvuXkOrpq7v7HaafM2nyZ
Malware Config
Extracted
emotet
Epoch2
71.72.196.159:80
134.209.36.254:8080
120.138.30.150:8080
94.23.216.33:80
157.245.99.39:8080
137.59.187.107:8080
94.23.237.171:443
61.19.246.238:443
156.155.166.221:80
50.35.17.13:80
153.137.36.142:80
91.211.88.52:7080
209.141.54.221:8080
185.94.252.104:443
174.45.13.118:80
87.106.136.232:8080
62.75.141.82:80
213.196.135.145:80
188.219.31.12:80
82.80.155.43:80
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet payload 3 IoCs
Detects Emotet payload in memory.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\03463167e46b424f19b8c5b7ab0a5702_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\03463167e46b424f19b8c5b7ab0a5702_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
60KB