Analysis
- max time kernel
139s - max time network
159s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
29/07/2024, 10:44
General
- Target 417c791e4eb8c7ac9ff0441b05baed3e_JaffaCakes118.exe
- Size 212KB
- Sample240729-mswx8avapl
- SHA256 106e2eca85041fca67d8f97b695a0801ccbb9a71d8193d98a3a814840c65fdeb
Malware Config
Extracted
-
emotet
-
Epoch3
-
49.243.9.118:80
-
167.71.227.113:8080
-
190.85.46.52:7080
-
162.144.42.60:8080
-
86.57.216.23:80
-
202.166.170.43:80
-
118.243.83.70:80
-
36.91.44.183:80
-
118.33.121.37:80
-
116.202.10.123:8080
-
113.193.239.51:443
-
169.1.211.133:80
-
192.163.221.191:8080
-
115.79.59.157:80
-
51.38.201.19:7080
-
45.177.120.37:8080
-
190.194.12.132:80
-
185.80.172.199:80
-
128.106.187.110:80
-
73.55.128.120:80
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Emotet payload 3 IoCs
Detects Emotet payload in memory.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\417c791e4eb8c7ac9ff0441b05baed3e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\417c791e4eb8c7ac9ff0441b05baed3e_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4756-7-0x00000000004C0000-0x00000000004CF000-memory.dmp
memory/4756-4-0x00000000004D0000-0x00000000004E0000-memory.dmp
memory/4756-0-0x00000000009C0000-0x00000000009D2000-memory.dmp