Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240730-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-07-2024 03:36

General

  • Target

    36500d8760818f9d3287217e47927271_JaffaCakes118.exe

  • Size

    149KB

  • MD5

    36500d8760818f9d3287217e47927271

  • SHA1

    1216a7a4097de3c41729343a640c7921fe975629

  • SHA256

    1aa0ca3fefd2b4fa5b9bf9b95bd43f078a9452c8a365ae2494aee22ee83e0816

  • SHA512

    5fe4897b5c4935813b070062ce381a5bc5211822ff97a5addf9f419812e08bfaaa86529f2b118c6d62be935674baba0ca413d09bfe0710cb1db3ba14f7cdc660

  • SSDEEP

    3072:WY4s5aoSrBTq/3s0Y6OtXjMAW1s7uA+ene1gef:WYNSI/tY6AjpL+enkgef

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

38.18.235.242:80

5.196.108.189:8080

121.124.124.40:7080

104.236.246.93:8080

113.61.66.94:80

120.150.60.189:80

91.211.88.52:7080

47.144.21.12:443

108.46.29.236:80

139.162.108.71:8080

134.209.36.254:8080

139.59.60.244:8080

66.65.136.14:80

76.175.162.101:80

174.106.122.139:80

95.213.236.64:8080

174.45.13.118:80

50.35.17.13:80

209.141.54.221:8080

87.106.139.101:8080

rsa_pubkey.plain
1
-----BEGIN PUBLIC KEY-----
2
MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhANQOcBKvh5xEW7VcJ9totsjdBwuAclxS
3
Q0e09fk8V053lktpW3TRrzAW63yt6j1KWnyxMrU3igFXypBoI4lVNmkje4UPtIIS
4
fkzjEIvG1v/ZNn1k0J0PfFTxbFFeUEs3AwIDAQAB
5
-----END PUBLIC KEY-----

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet payload 4 IoCs

    Detects Emotet payload in memory.

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\36500d8760818f9d3287217e47927271_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\36500d8760818f9d3287217e47927271_JaffaCakes118.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1144
    • C:\Windows\SysWOW64\KBDYCC\Windows.Globalization.PhoneNumberFormatting.exe
      "C:\Windows\SysWOW64\KBDYCC\Windows.Globalization.PhoneNumberFormatting.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:3464

Network

  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
    Response
    g.bing.com
    IN CNAME
    g-bing-com.dual-a-0034.a-msedge.net
    g-bing-com.dual-a-0034.a-msedge.net
    IN CNAME
    dual-a-0034.a-msedge.net
    dual-a-0034.a-msedge.net
    IN A
    204.79.197.237
    dual-a-0034.a-msedge.net
    IN A
    13.107.21.237
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=d17cdb33141b4a86845ae7cde6c92504&localId=w:AA283E2A-4922-A5E0-C674-D15FBC984EFD&deviceId=6896205211093653&anid=
    Remote address:
    204.79.197.237:443
    Request
    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=d17cdb33141b4a86845ae7cde6c92504&localId=w:AA283E2A-4922-A5E0-C674-D15FBC984EFD&deviceId=6896205211093653&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MUID=2F7A9084B1DD68FD1E738449B0FA6909; domain=.bing.com; expires=Mon, 25-Aug-2025 02:17:39 GMT; path=/; SameSite=None; Secure; Priority=High;
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: F5889DF72A7548798A815F46A5E598D7 Ref B: LON04EDGE0712 Ref C: 2024-07-31T02:17:39Z
    date: Wed, 31 Jul 2024 02:17:39 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=d17cdb33141b4a86845ae7cde6c92504&localId=w:AA283E2A-4922-A5E0-C674-D15FBC984EFD&deviceId=6896205211093653&anid=
    Remote address:
    204.79.197.237:443
    Request
    GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=d17cdb33141b4a86845ae7cde6c92504&localId=w:AA283E2A-4922-A5E0-C674-D15FBC984EFD&deviceId=6896205211093653&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=2F7A9084B1DD68FD1E738449B0FA6909
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MSPTC=7p7ZGFk5qmD9Ivpu7c7OUAXsv1iQzoRU05YAbJepZP4; domain=.bing.com; expires=Mon, 25-Aug-2025 02:17:39 GMT; path=/; Partitioned; secure; SameSite=None
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 41DF7DCB3AB94CF0AED540B69A191FF2 Ref B: LON04EDGE0712 Ref C: 2024-07-31T02:17:39Z
    date: Wed, 31 Jul 2024 02:17:39 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=d17cdb33141b4a86845ae7cde6c92504&localId=w:AA283E2A-4922-A5E0-C674-D15FBC984EFD&deviceId=6896205211093653&anid=
    Remote address:
    204.79.197.237:443
    Request
    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=d17cdb33141b4a86845ae7cde6c92504&localId=w:AA283E2A-4922-A5E0-C674-D15FBC984EFD&deviceId=6896205211093653&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=2F7A9084B1DD68FD1E738449B0FA6909; MSPTC=7p7ZGFk5qmD9Ivpu7c7OUAXsv1iQzoRU05YAbJepZP4
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: AA37C9F440914B9DBDDD59422D932E83 Ref B: LON04EDGE0712 Ref C: 2024-07-31T02:17:39Z
    date: Wed, 31 Jul 2024 02:17:39 GMT
  • flag-us
    DNS
    4.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    4.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    237.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    237.197.79.204.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    55.36.223.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    55.36.223.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    43.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    43.229.111.52.in-addr.arpa
    IN PTR
    Response
  • 204.79.197.237:443
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=d17cdb33141b4a86845ae7cde6c92504&localId=w:AA283E2A-4922-A5E0-C674-D15FBC984EFD&deviceId=6896205211093653&anid=
    tls, http2
    2.0kB
    9.3kB
    21
    19

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=d17cdb33141b4a86845ae7cde6c92504&localId=w:AA283E2A-4922-A5E0-C674-D15FBC984EFD&deviceId=6896205211093653&anid=

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=d17cdb33141b4a86845ae7cde6c92504&localId=w:AA283E2A-4922-A5E0-C674-D15FBC984EFD&deviceId=6896205211093653&anid=

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=d17cdb33141b4a86845ae7cde6c92504&localId=w:AA283E2A-4922-A5E0-C674-D15FBC984EFD&deviceId=6896205211093653&anid=

    HTTP Response

    204
  • 38.18.235.242:80
    Windows.Globalization.PhoneNumberFormatting.exe
    260 B
    5
  • 5.196.108.189:8080
    Windows.Globalization.PhoneNumberFormatting.exe
    260 B
    5
  • 121.124.124.40:7080
    Windows.Globalization.PhoneNumberFormatting.exe
    260 B
    200 B
    5
    5
  • 104.236.246.93:8080
    Windows.Globalization.PhoneNumberFormatting.exe
    260 B
    5
  • 52.111.227.13:443
    322 B
    7
  • 113.61.66.94:80
    Windows.Globalization.PhoneNumberFormatting.exe
    260 B
    5
  • 120.150.60.189:80
    Windows.Globalization.PhoneNumberFormatting.exe
    260 B
    5
  • 91.211.88.52:7080
    Windows.Globalization.PhoneNumberFormatting.exe
    208 B
    4
  • 8.8.8.8:53
    g.bing.com
    dns
    56 B
    151 B
    1
    1

    DNS Request

    g.bing.com

    DNS Response

    204.79.197.237
    13.107.21.237

  • 8.8.8.8:53
    4.159.190.20.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    4.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    237.197.79.204.in-addr.arpa
    dns
    73 B
    143 B
    1
    1

    DNS Request

    237.197.79.204.in-addr.arpa

  • 8.8.8.8:53
    55.36.223.20.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    55.36.223.20.in-addr.arpa

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
    128 B
    1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

  • 8.8.8.8:53
    43.229.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    43.229.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\KBDYCC\Windows.Globalization.PhoneNumberFormatting.exe

    Filesize

    149KB

    MD5

    36500d8760818f9d3287217e47927271

    SHA1

    1216a7a4097de3c41729343a640c7921fe975629

    SHA256

    1aa0ca3fefd2b4fa5b9bf9b95bd43f078a9452c8a365ae2494aee22ee83e0816

    SHA512

    5fe4897b5c4935813b070062ce381a5bc5211822ff97a5addf9f419812e08bfaaa86529f2b118c6d62be935674baba0ca413d09bfe0710cb1db3ba14f7cdc660

  • memory/1144-4-0x00000000005C0000-0x00000000005D0000-memory.dmp

    Filesize

    64KB

  • memory/1144-0-0x0000000000550000-0x0000000000562000-memory.dmp

    Filesize

    72KB

  • memory/1144-7-0x0000000000540000-0x000000000054F000-memory.dmp

    Filesize

    60KB

  • memory/1144-9-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/3464-10-0x00000000005A0000-0x00000000005B2000-memory.dmp

    Filesize

    72KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.