Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
28/04/2024, 08:28
General
-
Target
04c6eb664516a9c79f4347f2b8a8133f_JaffaCakes118.exe
-
Size
396KB
-
MD5
04c6eb664516a9c79f4347f2b8a8133f
-
SHA1
911ff6e2473bfadbf04fae998ab623048848f294
-
SHA256
c2032faa688bbaa0ad48a43d55998d737c911882c8e34886c5802649b96bfb38
-
SHA512
82d54f61bda497afac102683c4314342325996ecfdbb7fc4f8210b55ed5d8a05746f383dc4d1f8a1e57ee25939267747d942c5d79c928bfb011f2d6ea7e79039
-
SSDEEP
6144:8vov6BH3ifP7EOtDK2zHlZ6ybDdAhZ45UVzThYElyCWc+ZGgKy0rPmtu:8vRB3irlDKyHLbBfTGqa
Malware Config
Extracted
emotet
Epoch1
96.227.52.8:443
51.38.124.206:80
82.196.15.205:8080
38.88.126.202:8080
190.2.31.172:80
110.142.219.51:80
72.167.223.217:8080
138.97.60.141:7080
50.28.51.143:8080
5.189.178.202:8080
192.241.146.84:8080
190.195.129.227:8090
190.24.243.186:80
220.109.145.69:80
77.90.136.129:8080
185.178.10.77:80
94.176.234.118:443
178.250.54.208:8080
74.58.215.226:80
186.103.141.250:443
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet payload 3 IoCs
Detects Emotet payload in memory.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\04c6eb664516a9c79f4347f2b8a8133f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\04c6eb664516a9c79f4347f2b8a8133f_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
60KB