Analysis
-
max time kernel
138s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
22/05/2024, 17:51
General
-
Target
6819258e02d272f81584ac497b9fde55_JaffaCakes118.exe
-
Size
112KB
-
MD5
6819258e02d272f81584ac497b9fde55
-
SHA1
97ea42f033bfa18c14ebbce652123b7cee99540d
-
SHA256
854fe679510a6ff5275245d5fb912637ea9f843acb670f9509d1abc94acbf5b3
-
SHA512
fdf7ac44e23fa558e645dada362b5ddbd967a05968ca7b869a922cef54e4abb124e9d71c8227b447637d37ff16cb15836b891b846296e9c2252f01e6a29cd27c
-
SSDEEP
1536:zIyJFo4OTP8yQUtGvH7G5TJIyeyz29rc+ZqRNqiwm7EZ:5J24tyQUtG/S5narc+ZaqiDS
Malware Config
Extracted
emotet
Epoch2
71.72.196.159:80
134.209.36.254:8080
120.138.30.150:8080
94.23.216.33:80
157.245.99.39:8080
137.59.187.107:8080
94.23.237.171:443
61.19.246.238:443
156.155.166.221:80
50.35.17.13:80
153.137.36.142:80
91.211.88.52:7080
209.141.54.221:8080
185.94.252.104:443
174.45.13.118:80
87.106.136.232:8080
62.75.141.82:80
213.196.135.145:80
188.219.31.12:80
82.80.155.43:80
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet payload 3 IoCs
Detects Emotet payload in memory.
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6819258e02d272f81584ac497b9fde55_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6819258e02d272f81584ac497b9fde55_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
60KB