Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-05-2024 07:11

General

  • Target

    38e243b17d6eced70b7bc6d9f046bdec_JaffaCakes118.exe

  • Size

    112KB

  • MD5

    38e243b17d6eced70b7bc6d9f046bdec

  • SHA1

    302e25877ca6dca5eab75fdffc9c38feece4dbe4

  • SHA256

    a21aebc94c7ef44f2c2bedd4db006cb0ec24b1a8031c45134613908508e9fd91

  • SHA512

    7ff850664349775ac1f1a14fb3db4048fd4a2703f326fbad3f0a17d5dda32d8d7506780a8f5a39c5748eb15313e2ef1e261059a258c55a3f09656414b89e2291

  • SSDEEP

    1536:Q8Xm7Si+WxpgFr7tPiH/SYJFu8E0a3tiJVyAOmH7G/qvQR4thpwnK3BDzb14LWIW:Qp7SexWFrKSYJM306idbespZbcWIW

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

74.219.172.26:80

134.209.36.254:8080

104.156.59.7:8080

120.138.30.150:8080

194.187.133.160:443

104.236.246.93:8080

74.208.45.104:8080

78.187.156.31:80

187.161.206.24:80

94.23.216.33:80

172.91.208.86:80

91.211.88.52:7080

50.91.114.38:80

200.123.150.89:443

121.124.124.40:7080

62.75.141.82:80

5.196.74.210:8080

24.137.76.62:80

85.105.205.77:8080

139.130.242.43:80

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet payload 5 IoCs

    Detects Emotet payload in memory.

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\38e243b17d6eced70b7bc6d9f046bdec_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\38e243b17d6eced70b7bc6d9f046bdec_JaffaCakes118.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1100
    • C:\Windows\SysWOW64\dmenrollengine\profext.exe
      "C:\Windows\SysWOW64\dmenrollengine\profext.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4832

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\dmenrollengine\profext.exe

    Filesize

    112KB

    MD5

    38e243b17d6eced70b7bc6d9f046bdec

    SHA1

    302e25877ca6dca5eab75fdffc9c38feece4dbe4

    SHA256

    a21aebc94c7ef44f2c2bedd4db006cb0ec24b1a8031c45134613908508e9fd91

    SHA512

    7ff850664349775ac1f1a14fb3db4048fd4a2703f326fbad3f0a17d5dda32d8d7506780a8f5a39c5748eb15313e2ef1e261059a258c55a3f09656414b89e2291

  • memory/1100-4-0x00000000023A0000-0x00000000023B0000-memory.dmp

    Filesize

    64KB

  • memory/1100-0-0x0000000002380000-0x0000000002392000-memory.dmp

    Filesize

    72KB

  • memory/1100-7-0x0000000000BC0000-0x0000000000BCF000-memory.dmp

    Filesize

    60KB

  • memory/1100-9-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/4832-10-0x00000000026D0000-0x00000000026E2000-memory.dmp

    Filesize

    72KB

  • memory/4832-14-0x00000000026F0000-0x0000000002700000-memory.dmp

    Filesize

    64KB