Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
23-05-2024 20:04
General
-
Target
6c19e1b4e91e3437d0b3484b572683da_JaffaCakes118.exe
-
Size
360KB
-
MD5
6c19e1b4e91e3437d0b3484b572683da
-
SHA1
057bb50a0de6d209bb6fe0df727607c743d6182b
-
SHA256
cb09c9a80c4a399335c22ece90dc9a6f28a1fae7f23d95871d41fab59b0fa6af
-
SHA512
b6030a7c603ab6f59f5327d7eb797f17513a05e3100d0622b02d7cc9b827fd84a20cea04529af0c611996461b2e6ae46a2f37cf99ad97e79a74bc3308e724fb4
-
SSDEEP
6144:Ukps/EJxl4tfji9K/9AFnXQkT2r+t0ooMSuFjNw4VyJ6uhjqk:UkpsClQLMK/qXQkT2r+tFVSuHVyFF
Malware Config
Extracted
emotet
Epoch3
162.249.220.190:80
85.25.207.108:8080
178.128.14.92:8080
50.116.78.109:8080
181.113.229.139:443
192.241.220.183:8080
203.153.216.178:7080
177.32.8.85:80
139.99.157.213:8080
31.146.61.34:80
192.210.217.94:8080
188.251.213.180:443
185.208.226.142:8080
198.57.203.63:8080
220.254.198.228:443
201.213.177.139:80
197.221.158.162:80
95.216.205.155:8080
177.94.227.143:80
115.78.11.155:80
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c19e1b4e91e3437d0b3484b572683da_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6c19e1b4e91e3437d0b3484b572683da_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3776-0-0x0000000002280000-0x000000000228C000-memory.dmpFilesize
48KB
-
memory/3776-4-0x0000000002270000-0x0000000002279000-memory.dmpFilesize
36KB
-
memory/3776-5-0x0000000002280000-0x000000000228C000-memory.dmpFilesize
48KB