Analysis

  • max time kernel
    138s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-05-2024 04:48

General

  • Target

    0d8bc73982dbf82384e5fe24320a3656_JaffaCakes118.exe

  • Size

    248KB

  • MD5

    0d8bc73982dbf82384e5fe24320a3656

  • SHA1

    679e5e1386c557b51acc1780809434ae9a6f3684

  • SHA256

    484623515f85800e0f53f25dd9a5bedc192975351b4aaa174d2354b632f4216f

  • SHA512

    2b82b60b63f88d710cad0c24a7f9234f736be0240d7e5c5bb704f2ccaf355530c6470051a7e44c196d7ec8d98f92508d5430a379eb14ff5b9574d47a0b71aef8

  • SSDEEP

    6144:emVoblCdjhzrSt1VqZEd3/m2NOnVSgMK:emehCPrStCEuf

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

70.32.78.99:8080

213.189.36.51:8080

107.170.27.84:443

85.234.143.94:8080

200.58.83.179:80

51.15.8.192:8080

185.86.148.222:8080

91.83.93.124:7080

96.20.84.254:7080

200.123.101.90:80

181.135.153.203:443

186.15.83.52:8080

76.69.29.42:80

181.198.203.45:443

207.154.204.40:8080

212.71.237.140:8080

190.38.14.52:80

200.113.106.18:80

190.146.131.105:8080

163.172.40.218:7080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0d8bc73982dbf82384e5fe24320a3656_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0d8bc73982dbf82384e5fe24320a3656_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1412
    • C:\Users\Admin\AppData\Local\Temp\0d8bc73982dbf82384e5fe24320a3656_JaffaCakes118.exe
      --f31e7790
      2⤵
      • Suspicious behavior: RenamesItself
      PID:448
  • C:\Windows\SysWOW64\xclfill.exe
    "C:\Windows\SysWOW64\xclfill.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4160
    • C:\Windows\SysWOW64\xclfill.exe
      --a9e229fa
      2⤵
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      PID:2632

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\cfc8b1873e77dcd7e93893b04097b5e1_341ede6d-ed6e-4a9a-b21e-61c68ffcc45e

    Filesize

    50B

    MD5

    b1ecb35538fba014759f943d49f97d73

    SHA1

    2e4f3974e4ca15b1f897c8d5cce43c256590b1e6

    SHA256

    431638e80278251a13b7a0c468b0c62bd10de1f58a8509a51291fa40d5c2acff

    SHA512

    25ee7009d5a57c0a75513955e39f2833bc7db9be700ba13f939ba89a9b23a13892987c3606d0c4238e426f13a3ee4f895e9723f49d8ab4c92a34864b2ac8bb85

  • memory/448-6-0x0000000002060000-0x0000000002077000-memory.dmp

    Filesize

    92KB

  • memory/448-17-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

  • memory/1412-0-0x0000000000530000-0x0000000000547000-memory.dmp

    Filesize

    92KB

  • memory/1412-5-0x00000000004C0000-0x00000000004D1000-memory.dmp

    Filesize

    68KB

  • memory/4160-12-0x0000000000D60000-0x0000000000D77000-memory.dmp

    Filesize

    92KB