Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    12-05-2024 16:48

General

  • Target

    3b1ce788743336dc5dd352ae7b7bd588_JaffaCakes118.exe

  • Size

    420KB

  • MD5

    3b1ce788743336dc5dd352ae7b7bd588

  • SHA1

    34169022a270c8d94c26e7c3c9e7b7446c987218

  • SHA256

    8c2bd66fa3ddc9805b5e364bc8e434b099137aaf5cc7e799cabd179a7888c3db

  • SHA512

    2ba9a35aaade59075ef1ba25c7a730d86ebb1856bd437e625b8ebf0bf41d30bc344cf174afe18a38e3a80ea0b9e55abb253b8c162dfe2162a3301d86bab063c9

  • SSDEEP

    6144:QTEey77PAQXnL7maKRD0j2gqoAzQ222222222222U3XNagGZn4:quXn2aKRv/RdjG

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

173.81.218.65:80

45.55.36.51:443

91.83.93.99:7080

45.55.219.163:443

169.239.182.217:8080

24.43.99.75:80

78.24.219.147:8080

95.179.229.244:8080

107.5.122.110:80

47.144.21.12:443

204.197.146.48:80

139.99.158.11:443

190.160.53.126:80

74.120.55.163:80

74.109.108.202:80

47.146.117.214:80

104.236.246.93:8080

174.137.65.18:80

41.60.200.34:80

209.141.54.221:8080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3b1ce788743336dc5dd352ae7b7bd588_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3b1ce788743336dc5dd352ae7b7bd588_JaffaCakes118.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2012

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2012-0-0x00000000003A0000-0x00000000003AC000-memory.dmp

    Filesize

    48KB

  • memory/2012-4-0x0000000000380000-0x0000000000389000-memory.dmp

    Filesize

    36KB

  • memory/2012-5-0x00000000003A0000-0x00000000003AC000-memory.dmp

    Filesize

    48KB