Analysis

  • max time kernel
    146s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    28-07-2024 17:49

General

  • Target

    1a6c860e84a8e6c55df937aab0795525_JaffaCakes118.exe

  • Size

    528KB

  • MD5

    1a6c860e84a8e6c55df937aab0795525

  • SHA1

    d79dbebc5fe86908e369064736e56624aeac63b4

  • SHA256

    49b1f7e34f74b3ea4b97852292dfd6e856a58f74a181f5a3aadd6356503ae617

  • SHA512

    c559673daf3eb7bbd0dd6f162bf68117d2a1dba16bcb9c24778bcd66241cc8aa9c8cb5ec8fda6758e34241b333aedf718e8e2cf545f88dc594ae4158240f08fe

  • SSDEEP

    12288:wMcacEj+U5RyKETLgS0bskxpVehVzmacEuh+e8:wkckrW05ehVtcBt8

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

174.106.122.139:80

159.203.116.47:8080

173.249.6.108:443

104.236.246.93:8080

174.45.13.118:80

137.59.187.107:8080

94.200.114.161:80

37.187.72.193:8080

67.10.155.92:80

121.124.124.40:7080

24.43.99.75:80

75.139.38.211:80

109.74.5.95:8080

137.119.36.33:80

74.134.41.124:80

66.65.136.14:80

94.1.108.190:443

181.169.235.7:80

79.137.83.50:443

104.131.44.150:8080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet payload 3 IoCs

    Detects Emotet payload in memory.

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1a6c860e84a8e6c55df937aab0795525_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1a6c860e84a8e6c55df937aab0795525_JaffaCakes118.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:624
    • C:\Windows\SysWOW64\atmlib\vbscript.exe
      "C:\Windows\SysWOW64\atmlib\vbscript.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2652

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\pdata.css

    Filesize

    10B

    MD5

    12aff5250d099e8b54923baaa433a4b6

    SHA1

    1c3d2c100d93f9c16d2961bd02b2cdce019c360c

    SHA256

    1535895fea3509918515479905fb814e80657ea5db44bcd7bbdf6ffbde370de2

    SHA512

    47c7b3a3759a70953e53ff5fcaa0862bf1f84a3905020357407d86798c0ee898306da0d3c7d9e667dd3e81d840ea57330cf66ea8178dac2738e4c46690785552

  • C:\Windows\SysWOW64\atmlib\vbscript.exe

    Filesize

    528KB

    MD5

    1a6c860e84a8e6c55df937aab0795525

    SHA1

    d79dbebc5fe86908e369064736e56624aeac63b4

    SHA256

    49b1f7e34f74b3ea4b97852292dfd6e856a58f74a181f5a3aadd6356503ae617

    SHA512

    c559673daf3eb7bbd0dd6f162bf68117d2a1dba16bcb9c24778bcd66241cc8aa9c8cb5ec8fda6758e34241b333aedf718e8e2cf545f88dc594ae4158240f08fe

  • memory/624-14-0x0000000000280000-0x0000000000282000-memory.dmp

    Filesize

    8KB

  • memory/624-9-0x0000000000280000-0x0000000000282000-memory.dmp

    Filesize

    8KB

  • memory/624-5-0x0000000000280000-0x0000000000282000-memory.dmp

    Filesize

    8KB

  • memory/624-4-0x0000000000280000-0x0000000000282000-memory.dmp

    Filesize

    8KB

  • memory/624-11-0x0000000000280000-0x0000000000282000-memory.dmp

    Filesize

    8KB

  • memory/624-10-0x0000000000280000-0x0000000000282000-memory.dmp

    Filesize

    8KB

  • memory/624-7-0x0000000000280000-0x0000000000282000-memory.dmp

    Filesize

    8KB

  • memory/624-13-0x0000000000280000-0x0000000000282000-memory.dmp

    Filesize

    8KB

  • memory/624-12-0x0000000000280000-0x0000000000282000-memory.dmp

    Filesize

    8KB

  • memory/624-15-0x0000000000280000-0x0000000000282000-memory.dmp

    Filesize

    8KB

  • memory/624-16-0x0000000000280000-0x0000000000282000-memory.dmp

    Filesize

    8KB

  • memory/624-17-0x0000000000400000-0x0000000000488000-memory.dmp

    Filesize

    544KB

  • memory/624-18-0x0000000000390000-0x00000000003A0000-memory.dmp

    Filesize

    64KB

  • memory/624-22-0x0000000000400000-0x0000000000488000-memory.dmp

    Filesize

    544KB

  • memory/624-8-0x0000000000280000-0x0000000000282000-memory.dmp

    Filesize

    8KB

  • memory/624-6-0x0000000000280000-0x0000000000282000-memory.dmp

    Filesize

    8KB

  • memory/2652-44-0x00000000003D0000-0x00000000003E0000-memory.dmp

    Filesize

    64KB

  • memory/2652-39-0x00000000003C0000-0x00000000003C2000-memory.dmp

    Filesize

    8KB

  • memory/2652-34-0x00000000003C0000-0x00000000003C2000-memory.dmp

    Filesize

    8KB

  • memory/2652-32-0x00000000003C0000-0x00000000003C2000-memory.dmp

    Filesize

    8KB

  • memory/2652-31-0x00000000003C0000-0x00000000003C2000-memory.dmp

    Filesize

    8KB

  • memory/2652-36-0x00000000003C0000-0x00000000003C2000-memory.dmp

    Filesize

    8KB

  • memory/2652-37-0x00000000003C0000-0x00000000003C2000-memory.dmp

    Filesize

    8KB

  • memory/2652-35-0x00000000003C0000-0x00000000003C2000-memory.dmp

    Filesize

    8KB

  • memory/2652-40-0x00000000003C0000-0x00000000003C2000-memory.dmp

    Filesize

    8KB

  • memory/2652-38-0x00000000003C0000-0x00000000003C2000-memory.dmp

    Filesize

    8KB

  • memory/2652-42-0x00000000003C0000-0x00000000003C2000-memory.dmp

    Filesize

    8KB

  • memory/2652-41-0x00000000003C0000-0x00000000003C2000-memory.dmp

    Filesize

    8KB

  • memory/2652-43-0x0000000000400000-0x0000000000488000-memory.dmp

    Filesize

    544KB

  • memory/2652-49-0x00000000003D0000-0x00000000003E0000-memory.dmp

    Filesize

    64KB

  • memory/2652-48-0x0000000000400000-0x0000000000488000-memory.dmp

    Filesize

    544KB

  • memory/2652-33-0x00000000003C0000-0x00000000003C2000-memory.dmp

    Filesize

    8KB