Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
24-05-2024 12:48
General
-
Target
6e9269b18d28c76e10bf669585b5564b_JaffaCakes118.exe
-
Size
156KB
-
MD5
6e9269b18d28c76e10bf669585b5564b
-
SHA1
56ad152d0251d4000a04522492ddaeb48f214466
-
SHA256
863c72a223a34317dbaff7987792e9d743776e72dc9a880cbc006093a39e7d4a
-
SHA512
48d532cddcbb5bbe07cb532acd1b4aa0e442c76763df09d3679a55d53df70d425a9749166d3f46568f646ea9b408a8dcfdd999e7647759a342dc5c78ccd4c5a2
-
SSDEEP
3072:3E8Hiuuq5zv1PlPQ9vj/t+VeFuG/QotyQ62EOxX4Izk1:3XuqlPQ9vjF+wuG/Qo0tqxp
Malware Config
Extracted
emotet
Epoch3
118.110.236.121:8080
149.202.5.139:443
153.92.4.96:8080
51.75.163.68:7080
46.32.229.152:8080
192.241.220.183:8080
173.94.215.84:80
188.0.135.237:80
45.182.161.17:80
74.208.173.91:8080
81.214.253.80:443
157.7.164.178:8081
162.249.220.190:80
192.163.221.191:8080
77.74.78.80:443
175.29.183.2:80
190.190.15.20:80
188.251.213.180:443
222.159.240.58:80
175.139.144.229:8080
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e9269b18d28c76e10bf669585b5564b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6e9269b18d28c76e10bf669585b5564b_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1712-1-0x00000000003C0000-0x00000000003CC000-memory.dmpFilesize
48KB
-
memory/1712-0-0x00000000003A0000-0x00000000003A1000-memory.dmpFilesize
4KB
-
memory/1712-5-0x00000000003B0000-0x00000000003B9000-memory.dmpFilesize
36KB
-
memory/1712-6-0x00000000003C0000-0x00000000003CC000-memory.dmpFilesize
48KB