Analysis

  • max time kernel
    139s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-05-2024 13:55

General

  • Target

    677da5df48b40121c57cf3132b0b3a2a_JaffaCakes118.exe

  • Size

    667KB

  • MD5

    677da5df48b40121c57cf3132b0b3a2a

  • SHA1

    acbc4dc3793f4e7cc53fb8e4af127285c9d6d88e

  • SHA256

    693207b365add3b98578f9cb3d281e59ff999f0d93e3e2dbb6457a74469d6265

  • SHA512

    a77ec6841f30725e0ecdd1e77513f0862f0b64ab3b4554a272a8ebdfc7d70f862b273002063777c9526a8bfeaf8939a1cbde7711e7b9ede989c683db3c6084b2

  • SSDEEP

    12288:6+JJG//twCZ1CFy6jpcFnRO6QuiCDuBMoCJazA:6+J6/twC1N6jiVk6Quix4R

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

104.193.103.61:80

104.131.123.136:443

5.196.108.189:8080

121.124.124.40:7080

87.106.139.101:8080

213.196.135.145:80

50.35.17.13:80

38.18.235.242:80

24.43.32.186:80

82.80.155.43:80

103.86.49.11:8080

113.61.66.94:80

24.137.76.62:80

187.49.206.134:80

42.200.107.142:80

24.179.13.119:80

93.147.212.206:80

108.46.29.236:80

105.186.233.33:80

37.139.21.175:8080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet payload 3 IoCs

    Detects Emotet payload in memory.

  • Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\677da5df48b40121c57cf3132b0b3a2a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\677da5df48b40121c57cf3132b0b3a2a_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:3288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3288-4-0x0000000000640000-0x0000000000650000-memory.dmp
    Filesize

    64KB

  • memory/3288-0-0x0000000000660000-0x0000000000672000-memory.dmp
    Filesize

    72KB

  • memory/3288-7-0x0000000000620000-0x000000000062F000-memory.dmp
    Filesize

    60KB