Analysis

  • max time kernel
    142s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    28-07-2024 17:25

General

  • Target

    1996b23a32eb42d4b8fd19d139e6d396_JaffaCakes118.exe

  • Size

    400KB

  • MD5

    1996b23a32eb42d4b8fd19d139e6d396

  • SHA1

    b450ec5455efb2a470c064cd0b62735145c51323

  • SHA256

    5ad7322aac554e998403faa77ca45905768b92fa4d43844dfa25701f856e5bd2

  • SHA512

    2692e674274d145c3454d94e9bebb677e6434fed356b81ab640a7f64f9e6209906be464593c10b804f80e22050427c9c42c4bc10908cdcae603bf7c1a4de490e

  • SSDEEP

    3072:eKQAYgKE1PP7BDV2WNbX+Ob5C7se89qjkD6Kd/Y+oQ6vDJ1Es7uKE2YAmU7viNxF:kAzTBDPN7+wPe8QjW64oQ6LJ1/iN

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

104.193.103.61:80

104.131.123.136:443

5.196.108.189:8080

121.124.124.40:7080

87.106.139.101:8080

213.196.135.145:80

50.35.17.13:80

38.18.235.242:80

24.43.32.186:80

82.80.155.43:80

103.86.49.11:8080

113.61.66.94:80

24.137.76.62:80

187.49.206.134:80

42.200.107.142:80

24.179.13.119:80

93.147.212.206:80

108.46.29.236:80

105.186.233.33:80

37.139.21.175:8080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet payload 2 IoCs

    Detects Emotet payload in memory.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1996b23a32eb42d4b8fd19d139e6d396_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1996b23a32eb42d4b8fd19d139e6d396_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2392

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2392-14-0x0000000001DB0000-0x0000000001DB2000-memory.dmp

    Filesize

    8KB

  • memory/2392-13-0x0000000001DB0000-0x0000000001DB2000-memory.dmp

    Filesize

    8KB

  • memory/2392-12-0x0000000001DB0000-0x0000000001DB2000-memory.dmp

    Filesize

    8KB

  • memory/2392-11-0x0000000001DB0000-0x0000000001DB2000-memory.dmp

    Filesize

    8KB

  • memory/2392-10-0x0000000001DB0000-0x0000000001DB2000-memory.dmp

    Filesize

    8KB

  • memory/2392-9-0x0000000001DB0000-0x0000000001DB2000-memory.dmp

    Filesize

    8KB

  • memory/2392-8-0x0000000001DB0000-0x0000000001DB2000-memory.dmp

    Filesize

    8KB

  • memory/2392-7-0x0000000001DB0000-0x0000000001DB2000-memory.dmp

    Filesize

    8KB

  • memory/2392-6-0x0000000001DB0000-0x0000000001DB2000-memory.dmp

    Filesize

    8KB

  • memory/2392-5-0x0000000001DB0000-0x0000000001DB2000-memory.dmp

    Filesize

    8KB

  • memory/2392-4-0x0000000001DB0000-0x0000000001DB2000-memory.dmp

    Filesize

    8KB

  • memory/2392-3-0x0000000001DB0000-0x0000000001DB2000-memory.dmp

    Filesize

    8KB

  • memory/2392-15-0x0000000001DB0000-0x0000000001DB2000-memory.dmp

    Filesize

    8KB

  • memory/2392-16-0x0000000000439000-0x000000000043A000-memory.dmp

    Filesize

    4KB

  • memory/2392-17-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

    Filesize

    64KB

  • memory/2392-21-0x0000000000400000-0x0000000000467000-memory.dmp

    Filesize

    412KB

  • memory/2392-22-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

    Filesize

    64KB