Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    31-05-2024 06:00

General

  • Target

    8628a7cecefc6fac7fc7f5fa62b0adca_JaffaCakes118.exe

  • Size

    468KB

  • MD5

    8628a7cecefc6fac7fc7f5fa62b0adca

  • SHA1

    5c113ff0611ea4c72a15712cc177e50bd16f2c78

  • SHA256

    acd39d30e3935fb23beb56cf5706b50e3ba8a33032b410ec48bf8f48d97653ee

  • SHA512

    8e0b65ec159b6e2e4057d7552795ab6594b82a5af473fe8f5205e90b2dfe8e69959549467a6899838a61d6420ca5fcf970d60a923562ea37500e086ffee69020

  • SSDEEP

    6144:Lg5alZHCNqClhpALe+/LyK7AF0fY7S2KWCHLNQ:c5KCNqQ2a6b7NY7pKxC

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

95.9.180.128:80

87.98.218.33:7080

192.187.99.90:8080

190.181.235.46:80

181.129.96.162:8080

172.104.169.32:8080

24.148.98.177:80

202.62.39.111:80

192.241.143.52:8080

51.255.165.160:8080

116.125.120.88:443

89.32.150.160:8080

209.236.123.42:8080

178.79.163.131:8080

191.182.6.118:80

177.66.190.130:80

87.106.46.107:8080

217.199.160.224:7080

66.228.49.173:8080

94.176.234.118:443

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet payload 3 IoCs

    Detects Emotet payload in memory.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8628a7cecefc6fac7fc7f5fa62b0adca_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8628a7cecefc6fac7fc7f5fa62b0adca_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:3024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3024-0-0x0000000000270000-0x000000000027C000-memory.dmp
    Filesize

    48KB

  • memory/3024-4-0x0000000000260000-0x0000000000269000-memory.dmp
    Filesize

    36KB

  • memory/3024-5-0x0000000000270000-0x000000000027C000-memory.dmp
    Filesize

    48KB