Analysis
- max time kernel
148s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
14/05/2024, 02:37
General
- Target 3d95591fa51182ed17bc8d42e7de3f1d_JaffaCakes118.exe
- Size 72KB
- Sample240514-c4kdfsff8x
- SHA256 4a92850f35a6d0b635e3ca115ee5faa327d5debf1d34bcfccd90d87eec662d66
Malware Config
Extracted
-
emotet
-
Epoch3
-
118.2.218.1:80
-
51.254.140.91:7080
-
5.9.227.244:8080
-
51.75.163.68:7080
-
75.127.14.170:8080
-
101.50.232.218:80
-
175.139.144.229:8080
-
139.59.12.63:8080
-
2.144.244.204:443
-
175.29.183.2:80
-
86.98.143.163:80
-
210.1.219.238:80
-
73.84.105.76:80
-
185.208.226.142:8080
-
91.75.75.46:80
-
188.251.213.180:443
-
88.249.181.198:443
-
77.74.78.80:443
-
181.137.229.1:80
-
190.136.179.102:80
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Executes dropped EXE 1 IoCs
- Drops file in System32 directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d95591fa51182ed17bc8d42e7de3f1d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3d95591fa51182ed17bc8d42e7de3f1d_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\HNetCfgClient\RpcRtRemote.exe"C:\Windows\SysWOW64\HNetCfgClient\RpcRtRemote.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 4162⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2360 -ip 23601⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
RpcRtRemote.exe
memory/2360-0-0x0000000000AB0000-0x0000000000ABD000-memory.dmp
memory/2360-4-0x0000000000AC0000-0x0000000000ACC000-memory.dmp
memory/2360-7-0x0000000000A90000-0x0000000000A9B000-memory.dmp
memory/2360-17-0x0000000000400000-0x0000000000412000-memory.dmp
memory/3852-13-0x00000000009C0000-0x00000000009CC000-memory.dmp
memory/3852-9-0x00000000009B0000-0x00000000009BD000-memory.dmp