Analysis
-
max time kernel
135s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
01/06/2024, 13:01
General
-
Target
8a88382f91ce55f8a9b8c9ccbba5b40e_JaffaCakes118.exe
-
Size
544KB
-
MD5
8a88382f91ce55f8a9b8c9ccbba5b40e
-
SHA1
4c70786db20e07b21c02868e3b8c65d779111972
-
SHA256
4d344ed6caa06ff4011d38ad65da02e3534ccde7ec497470c86517c38f180a8b
-
SHA512
0dd1f5b90a75c49de195bdee2b90e86896703944feabc0bcd0a7d04679061e323646853cdfc496b7c02ebc5c531293f2a1b23c6052166b097136093501fd7256
-
SSDEEP
6144:LTp3XYyIMYUTgOBeWoavwiU0yx5C2222222222227pUnwXE1:LTp3XYBUEOBeGwiUZ8Cr1
Malware Config
Extracted
emotet
Epoch3
82.239.200.118:80
185.81.158.15:8080
51.255.15.193:7080
85.25.207.108:8080
107.161.30.122:8080
113.161.148.81:80
74.208.173.91:8080
139.59.12.63:8080
188.0.135.237:80
2.144.244.204:443
87.106.231.60:8080
181.137.229.1:80
173.94.215.84:80
175.29.183.2:80
37.46.129.215:8080
86.57.216.23:80
181.126.54.234:80
190.212.140.6:80
46.105.131.68:8080
190.190.15.20:80
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a88382f91ce55f8a9b8c9ccbba5b40e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8a88382f91ce55f8a9b8c9ccbba5b40e_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
-
Filesize
36KB
-
Filesize
48KB