Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
19-05-2024 15:56
General
-
Target
5a325e826f0e472423d778d71ce151f6_JaffaCakes118.exe
-
Size
446KB
-
MD5
5a325e826f0e472423d778d71ce151f6
-
SHA1
f4b484d500305eb5cfbbdecb0b2456769a79c743
-
SHA256
ce0291afe111b9a328def02c9adff6e6d80bc2243e2f382e1a384609b7d78aed
-
SHA512
3911ab999b2b6e3bb53604e74248acddbc7b28c58c8b07d5fa809e4d077f51909e2f2528c67fcc143a49b584042b165ecb00c9719fcc71fcf234b99962ea5177
-
SSDEEP
6144:NwekW4xuXsbOrp56tQvq6H/iawC7MLSnyZtC:NwvuXkOrp57v7HaafM2nyZ
Malware Config
Extracted
emotet
Epoch2
71.72.196.159:80
134.209.36.254:8080
120.138.30.150:8080
94.23.216.33:80
157.245.99.39:8080
137.59.187.107:8080
94.23.237.171:443
61.19.246.238:443
156.155.166.221:80
50.35.17.13:80
153.137.36.142:80
91.211.88.52:7080
209.141.54.221:8080
185.94.252.104:443
174.45.13.118:80
87.106.136.232:8080
62.75.141.82:80
213.196.135.145:80
188.219.31.12:80
82.80.155.43:80
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet payload 3 IoCs
Detects Emotet payload in memory.
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a325e826f0e472423d778d71ce151f6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5a325e826f0e472423d778d71ce151f6_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3804,i,15140928051103392835,1612840580898364401,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
60KB