Overview

overview

10

Static

static

3

0426c190f3...18.exe

windows7-x64

10

0426c190f3...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-04-2024 02:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0426c190f3a50491615801adbc851945_JaffaCakes118.exe

  • Size

    483KB

  • MD5

    0426c190f3a50491615801adbc851945

  • SHA1

    5bc87dc997af64d0430cfd5f32ce1b01f9253c98

  • SHA256

    58172da0d25c25a615faafeebb59a19b7f5c3e639d1f6785b0142e68446b9377

  • SHA512

    bf32eb3e831f8ac4bcb2f1a018c90385322924b6451dfe9360fcc3e4900b139cf3f9a6e7e1d1adc3026f88b50048d25a5ea6882e6d378b56641bae28d63606d4

  • SSDEEP

    12288:BoRKSt5ffQzhniC5BbxmLrZMFhle+3qvcN9wGdH1gGMeDp:DmLOhk+3qvcvwGdH1/9

Score
10/10
emotetepoch1bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

185.215.227.107:443

51.38.124.206:80

38.88.126.202:8080

54.37.42.48:8080

172.104.169.32:8080

68.183.190.199:8080

187.162.248.237:80

82.76.111.249:443

184.66.18.83:80

190.6.193.152:8080

77.238.212.227:80

199.203.62.165:80

188.2.217.94:80

185.94.252.12:80

178.250.54.208:8080

206.15.68.237:443

65.36.62.20:80

216.47.196.104:80

219.92.8.17:8080

213.60.96.117:80
rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0426c190f3a50491615801adbc851945_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0426c190f3a50491615801adbc851945_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2960
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4004 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:1408

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2960-0-0x0000000002330000-0x000000000233D000-memory.dmp
      Filesize

      52KB

      Download
    • memory/2960-4-0x0000000002440000-0x000000000244C000-memory.dmp
      Filesize

      48KB

      Download
    • memory/2960-8-0x0000000002320000-0x000000000232B000-memory.dmp
      Filesize

      44KB

      Download
    • memory/2960-7-0x0000000002310000-0x0000000002311000-memory.dmp
      Filesize

      4KB

      Download