Analysis
- max time kernel
134s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
15/06/2024, 02:52
General
- Target aca6c2e9dc0e639589fb302a76d29cca_JaffaCakes118.exe
- Size 667KB
- Sample240615-dcsfesxaqa
- SHA256 c087298502461a6f660687b19bf9826f6d3a971acce2c07be692aaf326045572
Malware Config
Extracted
-
emotet
-
Epoch1
-
202.22.141.45:80
-
37.187.161.206:8080
-
202.29.239.162:443
-
80.87.201.221:7080
-
82.76.111.249:443
-
216.47.196.104:80
-
192.241.143.52:8080
-
192.81.38.31:80
-
87.106.253.248:8080
-
64.201.88.132:80
-
192.241.146.84:8080
-
12.162.84.2:8080
-
1.226.84.243:8080
-
177.129.17.170:443
-
202.134.4.210:7080
-
70.169.17.134:80
-
152.169.22.67:80
-
5.196.35.138:7080
-
138.97.60.141:7080
-
203.205.28.68:80
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Emotet payload 5 IoCs
Detects Emotet payload in memory.
- Executes dropped EXE 1 IoCs
- Drops file in System32 directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aca6c2e9dc0e639589fb302a76d29cca_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\aca6c2e9dc0e639589fb302a76d29cca_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\UIAnimation\Windows.System.RemoteDesktop.exe"C:\Windows\SysWOW64\UIAnimation\Windows.System.RemoteDesktop.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Windows.System.RemoteDesktop.exe
memory/2024-14-0x0000000000540000-0x0000000000550000-memory.dmp
memory/2024-10-0x0000000000520000-0x0000000000532000-memory.dmp
memory/3664-4-0x0000000000660000-0x0000000000670000-memory.dmp
memory/3664-0-0x0000000000640000-0x0000000000652000-memory.dmp
memory/3664-7-0x0000000000610000-0x000000000061F000-memory.dmp
memory/3664-9-0x0000000000400000-0x00000000004AC000-memory.dmp