Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-06-2024 06:40

General

  • Target

    bb236ed597e45557c3c2f7497b69ab8f_JaffaCakes118.exe

  • Size

    634KB

  • MD5

    bb236ed597e45557c3c2f7497b69ab8f

  • SHA1

    0776f1b6d2fb9825e3ac064a052a8b93137df86b

  • SHA256

    970ae26ec18317c7bacd05c63f08ece0dc8726dc3e7dd030f172d4d765c141ee

  • SHA512

    ea2127405287f2b98468fd30081bd9a46362cbbdce08cf016fcc51dc4483de58f4ecc4f7c00826ba00f12868fa22d4488edd10abf127553d99a36ef9fa4aec00

  • SSDEEP

    6144:K9H+NDxL6GMGj8kl7muvrxwpntVsOGx4QKZXPk1jXPUVvfY0MAZ1by718jRJGu:KJ+Nd6Gmujx3uXPk1Dsm0b36WjRJG

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

45.16.226.117:443

91.121.54.71:8080

209.236.123.42:8080

89.32.150.160:8080

45.161.242.102:80

37.52.87.0:80

137.74.106.111:7080

71.197.211.156:80

217.199.160.224:7080

186.70.127.199:8090

50.28.51.143:8080

190.115.18.139:8080

85.105.140.135:443

24.148.98.177:80

181.30.61.163:443

192.241.146.84:8080

185.94.252.27:443

77.238.212.227:80

185.94.252.12:80

190.147.137.153:443

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bb236ed597e45557c3c2f7497b69ab8f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\bb236ed597e45557c3c2f7497b69ab8f_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4500-0-0x0000000002210000-0x000000000221C000-memory.dmp
    Filesize

    48KB

  • memory/4500-4-0x00000000021D0000-0x00000000021D1000-memory.dmp
    Filesize

    4KB

  • memory/4500-5-0x00000000021F0000-0x00000000021F9000-memory.dmp
    Filesize

    36KB

  • memory/4500-6-0x0000000002210000-0x000000000221C000-memory.dmp
    Filesize

    48KB