Analysis
-
max time kernel
143s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
26-05-2024 15:43
General
-
Target
75f84e04b64198dd207a8d7d29e7a6cc_JaffaCakes118.exe
-
Size
156KB
-
MD5
75f84e04b64198dd207a8d7d29e7a6cc
-
SHA1
eae0f3ae1266dd56ff5f70e5982d5f3caef6a817
-
SHA256
69501729b2461e10fab792b79df49a9eeaa98216eb66fdecd1c6439e108e8e50
-
SHA512
79c489e9184bb09514e04f3e0b89126d2cc3673feef68a4a3ca014d005c0bfd758c0f17cdc26ed1d6b9097dcf61a5cc2639b9c8886501c3d2ba86744256e0b5d
-
SSDEEP
3072:fE8Hiuuq5zv1PlPQ9vj/t+VeFne7JamJp2Lom9OTHk1:fXuqlPQ9vjF+wnesgmj
Malware Config
Extracted
emotet
Epoch1
50.121.220.50:80
51.75.33.122:80
54.37.42.48:8080
91.121.54.71:8080
83.169.21.32:7080
68.69.155.181:80
67.247.242.247:80
213.197.182.158:8080
45.173.88.33:80
111.67.12.221:8080
217.13.106.14:8080
191.99.160.58:80
178.148.55.236:8080
85.109.159.61:443
110.142.219.51:80
50.28.51.143:8080
77.90.136.129:8080
209.236.123.42:8080
72.135.200.124:80
184.66.18.83:80
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\75f84e04b64198dd207a8d7d29e7a6cc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\75f84e04b64198dd207a8d7d29e7a6cc_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3756 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4832-0-0x0000000002680000-0x000000000268C000-memory.dmpFilesize
48KB
-
memory/4832-5-0x0000000000A00000-0x0000000000A09000-memory.dmpFilesize
36KB
-
memory/4832-4-0x00000000009F0000-0x00000000009F1000-memory.dmpFilesize
4KB
-
memory/4832-6-0x0000000002680000-0x000000000268C000-memory.dmpFilesize
48KB