Analysis

  • max time kernel
    138s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-05-2024 12:22

General

  • Target

    10823dcd88f40366c77c8754dd74639a_JaffaCakes118.exe

  • Size

    327KB

  • MD5

    10823dcd88f40366c77c8754dd74639a

  • SHA1

    c933f837a17a5f5fc73dbca49c113b7e8886323c

  • SHA256

    5f7b9cf890b78207c8a62f98c7ee5606e620dfd0bc39cc7397066ee42a180e4c

  • SHA512

    3f2cc6119b4592701b6eafbcd6fed54a6bbe47d8ba77bafe07cb634d1a26d5168869006c6ab35a28709a062a80f1315410ee977bad518311ec9340b304193538

  • SSDEEP

    6144:9BZ2wMIvZsPPiNmauX3ZzHi1HHxTg3VOYqn2sgETCO2QA+xJX7G:p6Pigji1HHtgfPsg8J/i

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

185.215.227.107:443

51.38.124.206:80

38.88.126.202:8080

54.37.42.48:8080

172.104.169.32:8080

68.183.190.199:8080

187.162.248.237:80

82.76.111.249:443

184.66.18.83:80

190.6.193.152:8080

77.238.212.227:80

199.203.62.165:80

188.2.217.94:80

185.94.252.12:80

178.250.54.208:8080

206.15.68.237:443

65.36.62.20:80

216.47.196.104:80

219.92.8.17:8080

213.60.96.117:80

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\10823dcd88f40366c77c8754dd74639a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\10823dcd88f40366c77c8754dd74639a_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3184-0-0x00000000022A0000-0x00000000022AD000-memory.dmp

    Filesize

    52KB

  • memory/3184-4-0x00000000022B0000-0x00000000022BC000-memory.dmp

    Filesize

    48KB

  • memory/3184-7-0x0000000002290000-0x000000000229B000-memory.dmp

    Filesize

    44KB