Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    11-05-2024 10:18

General

  • Target

    341591acd10f2888f3e1edb1dfb18d6c_JaffaCakes118.exe

  • Size

    468KB

  • MD5

    341591acd10f2888f3e1edb1dfb18d6c

  • SHA1

    7c526399d1548e5fc23b6361d22488510e406f02

  • SHA256

    bacb712b3d74ed0fda20183fc224389b39707aa38f07ae9b226b219c5dff89b2

  • SHA512

    061d3560251d92241d0159012a4b3ea38a6ea1abf23de065fe9fefe52022879d20fe0b4960a8dbbd569324afcb32b9c14e2e6660f63ed4ae0ee0ae9f5898d299

  • SSDEEP

    6144:ka0lzIF1MpaYcN2PVgQfgfunByqVbuoMdVZPfiUUvX8HQHkd2LDEn+GfzO9+/S97:EEjMpaYk2PuUgfE7byrZP1SR

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

172.91.208.86:80

45.55.36.51:443

91.83.93.99:7080

45.55.219.163:443

107.5.122.110:80

103.86.49.11:8080

85.105.205.77:8080

120.150.60.189:80

137.59.187.107:8080

139.59.60.244:8080

203.117.253.142:80

1.221.254.82:80

97.82.79.83:80

37.187.72.193:8080

139.99.158.11:443

152.168.248.128:443

74.208.45.104:8080

83.169.36.251:8080

169.239.182.217:8080

216.208.76.186:80

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\341591acd10f2888f3e1edb1dfb18d6c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\341591acd10f2888f3e1edb1dfb18d6c_JaffaCakes118.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2940

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2940-0-0x0000000000290000-0x000000000029C000-memory.dmp

    Filesize

    48KB

  • memory/2940-4-0x0000000000280000-0x0000000000289000-memory.dmp

    Filesize

    36KB

  • memory/2940-5-0x0000000000290000-0x000000000029C000-memory.dmp

    Filesize

    48KB