Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
02-05-2024 14:56
General
-
Target
0ed0832251e72361cd783ccb4e015260_JaffaCakes118.exe
-
Size
446KB
-
MD5
0ed0832251e72361cd783ccb4e015260
-
SHA1
099f28a541ecf0898a8cbe4766945f26d3362d91
-
SHA256
4367002d9ba280a2349b5b0f23c0127a2f85a8afb135db2c4336db32b3467cca
-
SHA512
a24ef4c068d124bd3b6b2bc7780ecfba8bcadb7be72d5dad70672abf98d79afc9a0dae9dbeae7cbcb8075984631065193d31c2c8d57ea5ed445a8c21640b840d
-
SSDEEP
6144:NwekW4xuXsbOrpD6tQvq6H/iawC7MLSnyZtC:NwvuXkOrpD7v7HaafM2nyZ
Malware Config
Extracted
emotet
Epoch2
71.72.196.159:80
134.209.36.254:8080
120.138.30.150:8080
94.23.216.33:80
157.245.99.39:8080
137.59.187.107:8080
94.23.237.171:443
61.19.246.238:443
156.155.166.221:80
50.35.17.13:80
153.137.36.142:80
91.211.88.52:7080
209.141.54.221:8080
185.94.252.104:443
174.45.13.118:80
87.106.136.232:8080
62.75.141.82:80
213.196.135.145:80
188.219.31.12:80
82.80.155.43:80
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet payload 3 IoCs
Detects Emotet payload in memory.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ed0832251e72361cd783ccb4e015260_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0ed0832251e72361cd783ccb4e015260_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1728-0-0x0000000000310000-0x0000000000322000-memory.dmpFilesize
72KB
-
memory/1728-4-0x0000000000280000-0x0000000000290000-memory.dmpFilesize
64KB
-
memory/1728-7-0x0000000000270000-0x000000000027F000-memory.dmpFilesize
60KB