Analysis
- max time kernel
133s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
13/06/2024, 11:18
General
- Target a540eb8a20f941588630be7c74d781f5_JaffaCakes118.exe
- Size 668KB
- Sample240613-nejamswfja
- SHA256 d8a630ee96de9e152f9a15ee6313ace83d8c3359d6f2e2fa591f320d5a39bf3d
Malware Config
Extracted
-
emotet
-
Epoch1
-
202.22.141.45:80
-
37.187.161.206:8080
-
202.29.239.162:443
-
80.87.201.221:7080
-
82.76.111.249:443
-
216.47.196.104:80
-
192.241.143.52:8080
-
192.81.38.31:80
-
87.106.253.248:8080
-
64.201.88.132:80
-
192.241.146.84:8080
-
12.162.84.2:8080
-
1.226.84.243:8080
-
177.129.17.170:443
-
202.134.4.210:7080
-
70.169.17.134:80
-
152.169.22.67:80
-
5.196.35.138:7080
-
138.97.60.141:7080
-
203.205.28.68:80
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Emotet payload 5 IoCs
Detects Emotet payload in memory.
- Executes dropped EXE 1 IoCs
- Drops file in System32 directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a540eb8a20f941588630be7c74d781f5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a540eb8a20f941588630be7c74d781f5_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tsbyuv\Windows.StateRepositoryUpgrade.exe"C:\Windows\SysWOW64\tsbyuv\Windows.StateRepositoryUpgrade.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Windows.StateRepositoryUpgrade.exe
memory/2024-14-0x0000000002320000-0x0000000002330000-memory.dmp
memory/2024-10-0x0000000002300000-0x0000000002312000-memory.dmp
memory/3044-4-0x00000000022F0000-0x0000000002300000-memory.dmp
memory/3044-0-0x00000000022D0000-0x00000000022E2000-memory.dmp
memory/3044-7-0x00000000006A0000-0x00000000006AF000-memory.dmp
memory/3044-9-0x0000000000400000-0x00000000004AB000-memory.dmp