Analysis

  • max time kernel
    146s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    04-05-2024 07:35

General

  • Target

    11b3b1b5c2f6bdeff4a0e096e421dda7_JaffaCakes118.exe

  • Size

    896KB

  • MD5

    11b3b1b5c2f6bdeff4a0e096e421dda7

  • SHA1

    bd71a90d1a61c3074bfdbddc6b6c36bc65aa7693

  • SHA256

    b5b651472ee5d5baad6ab9e61b9b3b2eb59b87d68c689d08fc73d95ad9975463

  • SHA512

    d77c56cd69cf255c12ea03410cb22afe92cef8493831474af3d9e4dcec19e9ce44338e13f7b872eb9d83b5d7e3f9a8dfeaab6e17b986acd7dc08ea7581a585f6

  • SSDEEP

    12288:BZlyqwEmkmauSVd2R3R0EcX0euXBzsAsU3z4ZuF:jm6whk90BSyQ

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

174.100.27.229:80

209.126.6.222:8080

5.153.250.14:8080

192.241.146.84:8080

95.9.180.128:80

77.55.211.77:8080

85.105.140.135:443

45.33.77.42:8080

77.90.136.129:8080

94.176.234.118:443

190.163.31.26:80

190.6.193.152:8080

190.181.235.46:80

81.198.69.61:80

188.2.217.94:80

114.109.179.60:80

83.169.21.32:7080

137.74.106.111:7080

212.231.60.98:80

170.81.48.2:80

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet payload 3 IoCs

    Detects Emotet payload in memory.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\11b3b1b5c2f6bdeff4a0e096e421dda7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\11b3b1b5c2f6bdeff4a0e096e421dda7_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1708-0-0x00000000003A0000-0x00000000003AC000-memory.dmp

    Filesize

    48KB

  • memory/1708-4-0x0000000000280000-0x0000000000289000-memory.dmp

    Filesize

    36KB

  • memory/1708-5-0x00000000003A0000-0x00000000003AC000-memory.dmp

    Filesize

    48KB