Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-06-2024 19:47

General

  • Target

    b9b6ed320abb4ae798b19b20ed1ea24b_JaffaCakes118.exe

  • Size

    212KB

  • MD5

    b9b6ed320abb4ae798b19b20ed1ea24b

  • SHA1

    795db75b555ced61d39f399fb0235ac728309634

  • SHA256

    dda9f44bce3400c926aa5263bf9640dbdb6599f5f33db219deac1da0de4568fa

  • SHA512

    4c270baf62183503bd7ba3823ef48de258442c94a47dba8d6324df02d3ef92a1b8951a3b19deb24ea8b34b5dbc2dcb4f61cc844e879bf6a664566f2016bd1205

  • SSDEEP

    3072:YqHuHOn5SmyOMHudWmChnh7oMFHo/BcMir6epWu54tItpR:YqOK5SmyOH8F4cyepWy

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

63.248.198.8:80

189.19.81.181:443

130.204.247.253:80

96.126.121.64:443

104.236.137.72:8080

85.234.143.94:8080

51.255.165.160:8080

118.36.70.245:80

190.210.184.138:995

188.135.15.49:80

139.162.118.88:8080

72.29.55.174:80

68.183.170.114:8080

181.231.62.54:80

192.241.146.84:8080

71.76.45.83:443

63.246.252.234:80

37.211.49.127:80

74.59.187.94:80

5.88.27.67:8080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b9b6ed320abb4ae798b19b20ed1ea24b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b9b6ed320abb4ae798b19b20ed1ea24b_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1924
    • C:\Users\Admin\AppData\Local\Temp\b9b6ed320abb4ae798b19b20ed1ea24b_JaffaCakes118.exe
      --e879b88c
      2⤵
      • Suspicious behavior: RenamesItself
      • Suspicious use of SetWindowsHookEx
      PID:3860
  • C:\Windows\SysWOW64\hantprint.exe
    "C:\Windows\SysWOW64\hantprint.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1548
    • C:\Windows\SysWOW64\hantprint.exe
      --4abf4a64
      2⤵
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4224

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\01edac8cae020cd42786e051ebe37b67_6833eb7b-8d4b-4cdd-9502-9bbf7fc1cf9f
    Filesize

    50B

    MD5

    5f22af36aff2e43cacf9a56ba4166900

    SHA1

    914ede992f5edd5523a3a127a88f7bca60c69665

    SHA256

    e0671a7dbf4fca7d937ff1300471c5823a57786710faba9f85daf9e843281e3a

    SHA512

    f7fd666c6dcdae2bf235bb2b00791cf00519579e3181e5e3fd67e70c9a4027d48335b6498f6116efa5e513b7750b0eebeb484a63555d277939923bb48d4f3bc8

  • memory/1548-13-0x0000000000CE0000-0x0000000000CF7000-memory.dmp
    Filesize

    92KB

  • memory/1924-0-0x0000000002210000-0x0000000002211000-memory.dmp
    Filesize

    4KB

  • memory/1924-1-0x0000000002380000-0x0000000002397000-memory.dmp
    Filesize

    92KB

  • memory/1924-6-0x0000000002360000-0x0000000002371000-memory.dmp
    Filesize

    68KB

  • memory/3860-7-0x0000000002220000-0x0000000002237000-memory.dmp
    Filesize

    92KB

  • memory/3860-24-0x0000000000400000-0x0000000000438000-memory.dmp
    Filesize

    224KB

  • memory/4224-19-0x0000000000590000-0x00000000005A7000-memory.dmp
    Filesize

    92KB