Analysis

  • max time kernel
    131s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    02-05-2024 04:48

General

  • Target

    0d8bc73982dbf82384e5fe24320a3656_JaffaCakes118.exe

  • Size

    248KB

  • MD5

    0d8bc73982dbf82384e5fe24320a3656

  • SHA1

    679e5e1386c557b51acc1780809434ae9a6f3684

  • SHA256

    484623515f85800e0f53f25dd9a5bedc192975351b4aaa174d2354b632f4216f

  • SHA512

    2b82b60b63f88d710cad0c24a7f9234f736be0240d7e5c5bb704f2ccaf355530c6470051a7e44c196d7ec8d98f92508d5430a379eb14ff5b9574d47a0b71aef8

  • SSDEEP

    6144:emVoblCdjhzrSt1VqZEd3/m2NOnVSgMK:emehCPrStCEuf

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

70.32.78.99:8080

213.189.36.51:8080

107.170.27.84:443

85.234.143.94:8080

200.58.83.179:80

51.15.8.192:8080

185.86.148.222:8080

91.83.93.124:7080

96.20.84.254:7080

200.123.101.90:80

181.135.153.203:443

186.15.83.52:8080

76.69.29.42:80

181.198.203.45:443

207.154.204.40:8080

212.71.237.140:8080

190.38.14.52:80

200.113.106.18:80

190.146.131.105:8080

163.172.40.218:7080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 25 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0d8bc73982dbf82384e5fe24320a3656_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0d8bc73982dbf82384e5fe24320a3656_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1028
    • C:\Users\Admin\AppData\Local\Temp\0d8bc73982dbf82384e5fe24320a3656_JaffaCakes118.exe
      --f31e7790
      2⤵
      • Suspicious behavior: RenamesItself
      PID:2968
  • C:\Windows\SysWOW64\deploynic.exe
    "C:\Windows\SysWOW64\deploynic.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2652
    • C:\Windows\SysWOW64\deploynic.exe
      --6f313bd7
      2⤵
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      PID:2480

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1028-0-0x00000000005D0000-0x00000000005E7000-memory.dmp

    Filesize

    92KB

  • memory/1028-5-0x0000000000350000-0x0000000000361000-memory.dmp

    Filesize

    68KB

  • memory/2480-16-0x0000000000E70000-0x0000000000E87000-memory.dmp

    Filesize

    92KB

  • memory/2652-11-0x0000000000440000-0x0000000000457000-memory.dmp

    Filesize

    92KB

  • memory/2968-6-0x0000000000260000-0x0000000000277000-memory.dmp

    Filesize

    92KB

  • memory/2968-21-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB