Analysis
- max time kernel
147s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
18/06/2024, 00:45
General
- Target ba4d2a120b5bc244dec997c1c9d40de9_JaffaCakes118.exe
- Size 288KB
- Sample240618-a397davbnm
- SHA256 86fd072cd492271c43a65b3388118eb0668b0d33f1864c16160272134a1002e3
Score
10/10
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch1
C2
-
91.105.94.200:80
-
51.38.124.206:80
-
38.88.126.202:8080
-
54.37.42.48:8080
-
189.2.177.210:443
-
181.30.61.163:443
-
185.178.10.77:80
-
199.203.62.165:80
-
177.73.0.98:443
-
87.106.46.107:8080
-
5.196.35.138:7080
-
5.189.178.202:8080
-
185.183.16.47:80
-
78.249.119.122:80
-
191.182.6.118:80
-
96.227.52.8:443
-
186.103.141.250:443
-
50.28.51.143:8080
-
111.67.12.221:8080
-
50.121.220.50:80
rsa_pubkey.plain
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Emotet payload 3 IoCs
Detects Emotet payload in memory.
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba4d2a120b5bc244dec997c1c9d40de9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ba4d2a120b5bc244dec997c1c9d40de9_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4560-4-0x0000000002320000-0x0000000002330000-memory.dmp
memory/4560-0-0x0000000002300000-0x0000000002312000-memory.dmp
memory/4560-7-0x00000000022F0000-0x00000000022FF000-memory.dmp