Analysis

  • max time kernel
    144s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    18-06-2024 00:45

General

  • Target

    ba4d2a120b5bc244dec997c1c9d40de9_JaffaCakes118.exe

  • Size

    288KB

  • MD5

    ba4d2a120b5bc244dec997c1c9d40de9

  • SHA1

    89f0587c09576bc5bc934d4ec3e9111fd9301b25

  • SHA256

    86fd072cd492271c43a65b3388118eb0668b0d33f1864c16160272134a1002e3

  • SHA512

    369a24ad091b433842c1c07916382945fd45925de8284352b0b57469c992bfbd16719e325e7e769641fbef912cb05503f4e161c7acaa55cf4b60ec4d1169279d

  • SSDEEP

    6144:sEQeFi4nfbUgYfc67BTTljeCer9KlmdlK:sTR4nfIL5pRePYlmd

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

91.105.94.200:80

51.38.124.206:80

38.88.126.202:8080

54.37.42.48:8080

189.2.177.210:443

181.30.61.163:443

185.178.10.77:80

199.203.62.165:80

177.73.0.98:443

87.106.46.107:8080

5.196.35.138:7080

5.189.178.202:8080

185.183.16.47:80

78.249.119.122:80

191.182.6.118:80

96.227.52.8:443

186.103.141.250:443

50.28.51.143:8080

111.67.12.221:8080

50.121.220.50:80

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet payload 3 IoCs

    Detects Emotet payload in memory.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ba4d2a120b5bc244dec997c1c9d40de9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ba4d2a120b5bc244dec997c1c9d40de9_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2156-7-0x0000000000340000-0x000000000034F000-memory.dmp
    Filesize

    60KB

  • memory/2156-4-0x00000000003F0000-0x0000000000400000-memory.dmp
    Filesize

    64KB

  • memory/2156-0-0x0000000000350000-0x0000000000362000-memory.dmp
    Filesize

    72KB