Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240730-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-07-2024 02:58

General

  • Target

    34a5c1db6dd92caf27f2f09a3adc61f5_JaffaCakes118.exe

  • Size

    95KB

  • MD5

    34a5c1db6dd92caf27f2f09a3adc61f5

  • SHA1

    65dbb6b9f3dadcc291161b98feb6a8c94202ee48

  • SHA256

    cb0afb01af1ddf8330b7736f690feb3d951080ef6c13af0b1f0e0f7594109a73

  • SHA512

    c7a3a677a6a4f17811c07cc306a323c2205169c61ae06992d094fcd2a38816fcb3dc0f323d6ff3c345bb949a401a724b64d1318c84d5107685700b7ef944d248

  • SSDEEP

    1536:L5qy5eV2+suXluClZwmO/i2Q0mMx8ot+doa/7/vRoTIqaroBz0RoQ1eN:tq+KzXQClZlO/vRyc+T+mw4RoQ1o

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

38.18.235.242:80

5.196.108.189:8080

121.124.124.40:7080

104.236.246.93:8080

113.61.66.94:80

120.150.60.189:80

91.211.88.52:7080

47.144.21.12:443

108.46.29.236:80

139.162.108.71:8080

134.209.36.254:8080

139.59.60.244:8080

66.65.136.14:80

76.175.162.101:80

174.106.122.139:80

95.213.236.64:8080

174.45.13.118:80

50.35.17.13:80

209.141.54.221:8080

87.106.139.101:8080

rsa_pubkey.plain
1
-----BEGIN PUBLIC KEY-----
2
MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhANQOcBKvh5xEW7VcJ9totsjdBwuAclxS
3
Q0e09fk8V053lktpW3TRrzAW63yt6j1KWnyxMrU3igFXypBoI4lVNmkje4UPtIIS
4
fkzjEIvG1v/ZNn1k0J0PfFTxbFFeUEs3AwIDAQAB
5
-----END PUBLIC KEY-----

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet payload 5 IoCs

    Detects Emotet payload in memory.

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\34a5c1db6dd92caf27f2f09a3adc61f5_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\34a5c1db6dd92caf27f2f09a3adc61f5_JaffaCakes118.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:4256
    • C:\Windows\SysWOW64\werdiagcontroller\pstorec.exe
      "C:\Windows\SysWOW64\werdiagcontroller\pstorec.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1732

Network

  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
    Response
    g.bing.com
    IN CNAME
    g-bing-com.dual-a-0034.a-msedge.net
    g-bing-com.dual-a-0034.a-msedge.net
    IN CNAME
    dual-a-0034.a-msedge.net
    dual-a-0034.a-msedge.net
    IN A
    13.107.21.237
    dual-a-0034.a-msedge.net
    IN A
    204.79.197.237
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=28f0406cca66409eb4ea6f1ce4085cf2&localId=w:AC2B58A5-1A3B-8F5D-5E56-3F401D899D6C&deviceId=6966569283164616&anid=
    Remote address:
    13.107.21.237:443
    Request
    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=28f0406cca66409eb4ea6f1ce4085cf2&localId=w:AC2B58A5-1A3B-8F5D-5E56-3F401D899D6C&deviceId=6966569283164616&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MUID=0F47DC087BA368A80C8CC8C57A436951; domain=.bing.com; expires=Mon, 25-Aug-2025 01:40:36 GMT; path=/; SameSite=None; Secure; Priority=High;
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 4F11E863AFFF4E3BBCCA2480AC514447 Ref B: LON04EDGE1205 Ref C: 2024-07-31T01:40:36Z
    date: Wed, 31 Jul 2024 01:40:36 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=28f0406cca66409eb4ea6f1ce4085cf2&localId=w:AC2B58A5-1A3B-8F5D-5E56-3F401D899D6C&deviceId=6966569283164616&anid=
    Remote address:
    13.107.21.237:443
    Request
    GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=28f0406cca66409eb4ea6f1ce4085cf2&localId=w:AC2B58A5-1A3B-8F5D-5E56-3F401D899D6C&deviceId=6966569283164616&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=0F47DC087BA368A80C8CC8C57A436951
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MSPTC=EUQ0WkJvHyNLSZVyKc1PoM3O9RJQUAs91T7GZhV000I; domain=.bing.com; expires=Mon, 25-Aug-2025 01:40:36 GMT; path=/; Partitioned; secure; SameSite=None
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 16A0537C0EAE449AB43DEDAA729C2DC6 Ref B: LON04EDGE1205 Ref C: 2024-07-31T01:40:36Z
    date: Wed, 31 Jul 2024 01:40:36 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=28f0406cca66409eb4ea6f1ce4085cf2&localId=w:AC2B58A5-1A3B-8F5D-5E56-3F401D899D6C&deviceId=6966569283164616&anid=
    Remote address:
    13.107.21.237:443
    Request
    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=28f0406cca66409eb4ea6f1ce4085cf2&localId=w:AC2B58A5-1A3B-8F5D-5E56-3F401D899D6C&deviceId=6966569283164616&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=0F47DC087BA368A80C8CC8C57A436951; MSPTC=EUQ0WkJvHyNLSZVyKc1PoM3O9RJQUAs91T7GZhV000I
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 671BA9F906214577B1A2660935939427 Ref B: LON04EDGE1205 Ref C: 2024-07-31T01:40:36Z
    date: Wed, 31 Jul 2024 01:40:36 GMT
  • flag-us
    DNS
    237.21.107.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    237.21.107.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    64.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    64.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    57.169.31.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    57.169.31.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    81.144.22.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    81.144.22.2.in-addr.arpa
    IN PTR
    Response
    81.144.22.2.in-addr.arpa
    IN PTR
    a2-22-144-81deploystaticakamaitechnologiescom
  • flag-us
    DNS
    30.243.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    30.243.111.52.in-addr.arpa
    IN PTR
    Response
  • 13.107.21.237:443
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=28f0406cca66409eb4ea6f1ce4085cf2&localId=w:AC2B58A5-1A3B-8F5D-5E56-3F401D899D6C&deviceId=6966569283164616&anid=
    tls, http2
    2.0kB
    9.3kB
    22
    19

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=28f0406cca66409eb4ea6f1ce4085cf2&localId=w:AC2B58A5-1A3B-8F5D-5E56-3F401D899D6C&deviceId=6966569283164616&anid=

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=28f0406cca66409eb4ea6f1ce4085cf2&localId=w:AC2B58A5-1A3B-8F5D-5E56-3F401D899D6C&deviceId=6966569283164616&anid=

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=28f0406cca66409eb4ea6f1ce4085cf2&localId=w:AC2B58A5-1A3B-8F5D-5E56-3F401D899D6C&deviceId=6966569283164616&anid=

    HTTP Response

    204
  • 38.18.235.242:80
    pstorec.exe
    260 B
    5
  • 5.196.108.189:8080
    pstorec.exe
    260 B
    5
  • 121.124.124.40:7080
    pstorec.exe
    260 B
    200 B
    5
    5
  • 104.236.246.93:8080
    pstorec.exe
    260 B
    5
  • 113.61.66.94:80
    pstorec.exe
    260 B
    5
  • 120.150.60.189:80
    pstorec.exe
    260 B
    5
  • 91.211.88.52:7080
    pstorec.exe
    208 B
    4
  • 8.8.8.8:53
    g.bing.com
    dns
    56 B
    151 B
    1
    1

    DNS Request

    g.bing.com

    DNS Response

    13.107.21.237
    204.79.197.237

  • 8.8.8.8:53
    237.21.107.13.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    237.21.107.13.in-addr.arpa

  • 8.8.8.8:53
    64.159.190.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    64.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    57.169.31.20.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    57.169.31.20.in-addr.arpa

  • 8.8.8.8:53
    81.144.22.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    81.144.22.2.in-addr.arpa

  • 8.8.8.8:53
    30.243.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    30.243.111.52.in-addr.arpa

  • 8.8.8.8:53

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\werdiagcontroller\pstorec.exe

    Filesize

    95KB

    MD5

    34a5c1db6dd92caf27f2f09a3adc61f5

    SHA1

    65dbb6b9f3dadcc291161b98feb6a8c94202ee48

    SHA256

    cb0afb01af1ddf8330b7736f690feb3d951080ef6c13af0b1f0e0f7594109a73

    SHA512

    c7a3a677a6a4f17811c07cc306a323c2205169c61ae06992d094fcd2a38816fcb3dc0f323d6ff3c345bb949a401a724b64d1318c84d5107685700b7ef944d248

  • memory/1732-14-0x00000000005F0000-0x0000000000600000-memory.dmp

    Filesize

    64KB

  • memory/1732-10-0x0000000000610000-0x0000000000622000-memory.dmp

    Filesize

    72KB

  • memory/4256-0-0x0000000000A00000-0x0000000000A12000-memory.dmp

    Filesize

    72KB

  • memory/4256-4-0x0000000000A20000-0x0000000000A30000-memory.dmp

    Filesize

    64KB

  • memory/4256-7-0x00000000009F0000-0x00000000009FF000-memory.dmp

    Filesize

    60KB

  • memory/4256-9-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.