Overview

overview

10

Static

static

3

5a588866a1...18.exe

windows7-x64

10

5a588866a1...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-05-2024 16:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5a588866a1e94db94d3ad60ddfe6249e_JaffaCakes118.exe

  • Size

    236KB

  • MD5

    5a588866a1e94db94d3ad60ddfe6249e

  • SHA1

    97fa5999c9a5ad4812357bf96e8f2707915bfa3f

  • SHA256

    a15544ef0a8feebfc99ff6da851ff5af103399e0e3237dad07eb7b1c882a27ea

  • SHA512

    852438461eb736c257e5ed2230892ad35e54d265c427ef4adbba40bb1185c58b5afb9e536cdf8a3476ec0f4d6bca4b98ad6bd2633025baf4af1d991d54c3974d

  • SSDEEP

    3072:zLdGL9Wt2ltzymHv7BeQj7UnIo9vPU0iGGaaDVU1RIMvP507:1i9WtytJsU0ZOq1RZvP

Score
10/10
emotetepoch2bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

68.44.137.144:443

69.30.203.214:8080

67.205.85.243:8080

79.98.24.39:8080

5.196.74.210:8080

188.83.220.2:443

109.116.214.124:443

203.117.253.142:80

104.131.11.150:443

97.82.79.83:80

121.124.124.40:7080

83.169.36.251:8080

89.186.91.200:443

70.167.215.250:8080

204.197.146.48:80

167.86.90.214:8080

190.160.53.126:80

95.213.236.64:8080

47.144.21.12:443

169.239.182.217:8080
rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Emotet payload 3 IoCs

    Detects Emotet payload in memory.

    trojanbanker
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5a588866a1e94db94d3ad60ddfe6249e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5a588866a1e94db94d3ad60ddfe6249e_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2348
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1320,i,17096020621006928097,15544233752327415349,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:8
    1⤵
      PID:5092

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2348-0-0x00000000023A0000-0x00000000023AC000-memory.dmp

      Filesize

      48KB

      Download

    • memory/2348-4-0x0000000002390000-0x0000000002399000-memory.dmp

      Filesize

      36KB

      Download

    • memory/2348-5-0x00000000023A0000-0x00000000023AC000-memory.dmp

      Filesize

      48KB

      Download