Analysis
- max time kernel
142s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
05/06/2024, 08:22
General
- Target 979cf1f4e6c6853b73810f528a4788d1_JaffaCakes118.exe
- Size 464KB
- Sample240605-j92m9abe63
- SHA256 32a3c25b4ebf450e268594576a0a9a9caca66013e4bafe9f9073206c67d5b0b1
Score
10/10
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch2
C2
-
204.197.146.48:80
-
212.51.142.238:8080
-
200.55.243.138:8080
-
103.86.49.11:8080
-
83.110.223.58:443
-
139.130.242.43:80
-
41.60.200.34:80
-
110.145.77.103:80
-
183.101.175.193:80
-
50.116.86.205:8080
-
79.98.24.39:8080
-
180.92.239.110:8080
-
203.153.216.189:7080
-
137.59.187.107:8080
-
109.74.5.95:8080
-
61.19.246.238:443
-
209.182.216.177:443
-
162.241.92.219:8080
-
47.153.182.47:80
-
176.111.60.55:8080
rsa_pubkey.plain
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Emotet payload 3 IoCs
Detects Emotet payload in memory.
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\979cf1f4e6c6853b73810f528a4788d1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\979cf1f4e6c6853b73810f528a4788d1_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4964-4-0x00000000024C0000-0x00000000024C9000-memory.dmp
memory/4964-0-0x00000000024D0000-0x00000000024DC000-memory.dmp
memory/4964-5-0x00000000024D0000-0x00000000024DC000-memory.dmp
memory/4964-6-0x0000000002510000-0x0000000002601000-memory.dmp