Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
02-05-2024 10:26
General
-
Target
0e3df73d2b470b4d4c601b2c57933321_JaffaCakes118.exe
-
Size
634KB
-
MD5
0e3df73d2b470b4d4c601b2c57933321
-
SHA1
83814c2b47fd1d4ce35584860852da02f64c2fd0
-
SHA256
ff49bb5d2ae1e4f6b7ef9509b9ca5563c91e4498ced9819860edcb847255d302
-
SHA512
af5d1b776302e9ace28c018d9eb162bde8c546b04bcee89fe2513538ee246ddfe4e8d15fa3f56bfd6cc0ad9a0bd6e97f480ed6ce478c25688a6b5e4082c53822
-
SSDEEP
6144:F9H+NDxL6GMGj8kl7muvrxwpntVsOGx4QKZXPk1jXPUVvfY0MA/1by7iNAJGu:FJ+Nd6Gmujx3uXPk1Dsm0bN6+AJG
Malware Config
Extracted
emotet
Epoch2
67.68.210.95:80
162.241.242.173:8080
45.55.36.51:443
45.55.219.163:443
68.188.112.97:80
46.105.131.79:8080
78.24.219.147:8080
37.70.8.161:80
153.232.188.106:80
209.141.54.221:8080
203.117.253.142:80
152.168.248.128:443
93.147.212.206:80
24.137.76.62:80
189.212.199.126:443
204.197.146.48:80
137.119.36.33:80
185.94.252.104:443
139.130.242.43:80
203.153.216.189:7080
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e3df73d2b470b4d4c601b2c57933321_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0e3df73d2b470b4d4c601b2c57933321_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4068-0-0x0000000002220000-0x000000000222C000-memory.dmpFilesize
48KB
-
memory/4068-4-0x0000000002160000-0x0000000002161000-memory.dmpFilesize
4KB
-
memory/4068-5-0x0000000002180000-0x0000000002189000-memory.dmpFilesize
36KB
-
memory/4068-6-0x0000000002220000-0x000000000222C000-memory.dmpFilesize
48KB