Analysis
- max time kernel
140s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
04/06/2024, 10:43
General
- Target 948935c5361d563f74a28c4c0055db98_JaffaCakes118.exe
- Size 1.1MB
- Sample240604-mr8wdsdf4x
- SHA256 6605939089854b93ad1f6c889faa7621d644f54e76deefd937efaa74e082c82e
Score
10/10
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch1
C2
-
50.121.220.50:80
-
51.75.33.122:80
-
54.37.42.48:8080
-
91.121.54.71:8080
-
45.16.226.117:443
-
68.69.155.181:80
-
213.60.96.117:80
-
77.55.211.77:8080
-
152.169.22.67:80
-
110.142.219.51:80
-
2.47.112.152:80
-
206.15.68.237:443
-
217.13.106.14:8080
-
191.99.160.58:80
-
189.131.57.131:80
-
213.197.182.158:8080
-
94.176.234.118:443
-
61.92.159.208:8080
-
190.128.173.10:80
-
219.92.8.17:8080
rsa_pubkey.plain
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\948935c5361d563f74a28c4c0055db98_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\948935c5361d563f74a28c4c0055db98_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4320,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=1416 /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4144-1-0x0000000002300000-0x000000000230C000-memory.dmp
memory/4144-4-0x00000000022F0000-0x00000000022F9000-memory.dmp
memory/4144-5-0x0000000002300000-0x000000000230C000-memory.dmp
memory/4144-6-0x0000000002320000-0x0000000002352000-memory.dmp