Analysis

  • max time kernel
    144s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-05-2024 02:45

General

  • Target

    1147db0a1cc578a5620175f9054aade3_JaffaCakes118.exe

  • Size

    204KB

  • MD5

    1147db0a1cc578a5620175f9054aade3

  • SHA1

    4a809a3c3b2b76c21db8a0d815d0d70152874116

  • SHA256

    9f8819bddcdbabef91e6b91871152c86c79d67fdf423aa48caf337e15e441e1e

  • SHA512

    a1b30c7622834039403315e97805e199d29716f4c138b455fb567547f0ed19bf270dd78a6b8588a26167d355d7f793124ab8c5b6e56803e35d0ac77484bcdcb9

  • SSDEEP

    3072:wlVtIDQQq222222222222K7DnB5US8Ps0:bQz222222222222K7bqPD

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

37.52.87.0:80

87.118.70.45:8080

91.121.54.71:8080

116.125.120.88:443

24.135.198.218:80

103.106.236.83:8080

219.92.13.25:80

89.32.150.160:8080

24.135.1.177:80

82.196.15.205:8080

190.147.137.153:443

170.81.48.2:80

51.159.23.217:443

77.55.211.77:8080

204.225.249.100:7080

191.182.6.118:80

188.2.217.94:80

61.92.159.208:8080

152.169.22.67:80

172.104.169.32:8080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1147db0a1cc578a5620175f9054aade3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1147db0a1cc578a5620175f9054aade3_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1648-0-0x00000000023A0000-0x00000000023AC000-memory.dmp

    Filesize

    48KB

  • memory/1648-4-0x0000000002390000-0x0000000002399000-memory.dmp

    Filesize

    36KB

  • memory/1648-5-0x00000000023A0000-0x00000000023AC000-memory.dmp

    Filesize

    48KB