Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
19-05-2024 08:20
General
-
Target
596fff3bab9438ec1e9549caab2877f3_JaffaCakes118.exe
-
Size
448KB
-
MD5
596fff3bab9438ec1e9549caab2877f3
-
SHA1
7bb757677efe4e6cd9fba5ae8e9bd7eb9754437c
-
SHA256
f0948a64892d8a3e01ffdf798556e1da4634d5f115ba4b9b76c60f760d1f5bb5
-
SHA512
1e57878da8d7c1af35e63848c179c9f4c67dfe8c88a3063baf0715cf57c6e78b55b637f13214ab9d27ecbc80e1922700becf851252c3b0e10d7c64c6f1b30c0a
-
SSDEEP
12288:SfzaBuiszJbE9mO4sl9kVlAOyQkNvOzxMrB:SbMmO4sl9sR2Otq
Malware Config
Extracted
emotet
Epoch2
75.139.38.211:80
69.30.203.214:8080
67.205.85.243:8080
190.160.53.126:80
183.101.175.193:80
137.59.187.107:8080
168.235.67.138:7080
209.143.35.232:80
180.92.239.110:8080
167.86.90.214:8080
85.66.181.138:80
95.213.236.64:8080
83.169.36.251:8080
157.245.99.39:8080
79.98.24.39:8080
70.167.215.250:8080
93.51.50.171:8080
174.102.48.180:80
24.179.13.119:80
41.60.200.34:80
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet payload 3 IoCs
Detects Emotet payload in memory.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\596fff3bab9438ec1e9549caab2877f3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\596fff3bab9438ec1e9549caab2877f3_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1848-0-0x0000000000310000-0x000000000031C000-memory.dmpFilesize
48KB
-
memory/1848-4-0x0000000000300000-0x0000000000309000-memory.dmpFilesize
36KB
-
memory/1848-5-0x0000000000310000-0x000000000031C000-memory.dmpFilesize
48KB