Analysis

  • max time kernel
    135s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-06-2024 07:13

General

  • Target

    89b63812470298af35ff840ac1a677b9_JaffaCakes118.exe

  • Size

    188KB

  • MD5

    89b63812470298af35ff840ac1a677b9

  • SHA1

    ee6b893101be7c6cea409f2f83e196e92a8d9aea

  • SHA256

    19bd8896664629146102b5814ff71d5d215007e493d2aa3fe610c88c29209313

  • SHA512

    5ffaff4cf88df950e9b8712738b0fddfb7edf4e5502a648a84bcb8b8e197aedf1fd2c272b5e5fb5ae3243e6ae056ac5b4d909bfa528555605925b7b5cd1fac0a

  • SSDEEP

    3072:WcosYS2q2/4NPx3Q+3d4SICmvcwaQH2ZaD58EdLdsFTTIp5+1Xr07V62H50EJE:VoqcqPhxN4SIL1HH2ZaDecJsxcp5+1Xk

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

174.113.69.136:80

51.38.124.206:80

82.196.15.205:8080

38.88.126.202:8080

190.115.18.139:8080

98.13.75.196:80

181.30.61.163:443

82.76.111.249:443

181.129.96.162:8080

74.58.215.226:80

68.69.155.181:80

188.135.15.49:80

190.163.31.26:80

50.121.220.50:80

51.159.23.217:443

2.47.112.152:80

185.215.227.107:443

217.13.106.14:8080

70.32.115.157:8080

170.81.48.2:80

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet payload 3 IoCs

    Detects Emotet payload in memory.

  • Modifies registry class 14 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\89b63812470298af35ff840ac1a677b9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\89b63812470298af35ff840ac1a677b9_JaffaCakes118.exe"
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/5036-0-0x00000000024D0000-0x00000000024E2000-memory.dmp
    Filesize

    72KB

  • memory/5036-5-0x00000000024F0000-0x0000000002500000-memory.dmp
    Filesize

    64KB

  • memory/5036-7-0x00000000024C0000-0x00000000024CF000-memory.dmp
    Filesize

    60KB