Analysis
-
max time kernel
136s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
01-05-2024 01:13
General
-
Target
0acd02f8234152009b46344b00e7dc1c_JaffaCakes118.exe
-
Size
228KB
-
MD5
0acd02f8234152009b46344b00e7dc1c
-
SHA1
163ebe8fcc44deb23ff16cc3b0a58e127a3bb196
-
SHA256
39eb081c94ecb5f1b052185113ceb579f65eaee0a8931adeb3348966d1293776
-
SHA512
4012b0f8cd7c205e0c0ad1bc013b586996a8657d41c94d95927ac925b32db7e65ad9ec6bf27ba4b5d013e983b49a070b9c9ffcb1eeb4d7a19aba7b10f4bc2b69
-
SSDEEP
3072:IY7i9P50fNlwpHzAFE4nga4YKO1fUMqKXkbbd4b:TGFNzAZga4nx4a6
Malware Config
Extracted
emotet
Epoch2
174.106.122.139:80
159.203.116.47:8080
173.249.6.108:443
104.236.246.93:8080
174.45.13.118:80
137.59.187.107:8080
94.200.114.161:80
37.187.72.193:8080
67.10.155.92:80
121.124.124.40:7080
24.43.99.75:80
75.139.38.211:80
109.74.5.95:8080
137.119.36.33:80
74.134.41.124:80
66.65.136.14:80
94.1.108.190:443
181.169.235.7:80
79.137.83.50:443
104.131.44.150:8080
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet payload 3 IoCs
Detects Emotet payload in memory.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0acd02f8234152009b46344b00e7dc1c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0acd02f8234152009b46344b00e7dc1c_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/752-4-0x00000000006D0000-0x00000000006E0000-memory.dmpFilesize
64KB
-
memory/752-7-0x00000000006A0000-0x00000000006AF000-memory.dmpFilesize
60KB
-
memory/752-0-0x00000000006B0000-0x00000000006C2000-memory.dmpFilesize
72KB