Analysis

  • max time kernel
    141s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-07-2024 02:03

General

  • Target

    6e8e0f107d9054863a4ce11311a4ce6a_JaffaCakes118.exe

  • Size

    574KB

  • MD5

    6e8e0f107d9054863a4ce11311a4ce6a

  • SHA1

    76fbf9aae5591f047b7172a5e71438e1e45422a8

  • SHA256

    80d42a44dba7d66465a19417c22bed8e19a357ea4d07616eb205f8130ae18f43

  • SHA512

    c11a6be3823082cde872602b17f2398dfd72f897005be064411dd111dcf0b72d2b36781a1743fe545378215290924eaaf54a7ae5c6fd4282e3fd2e64ab985ce1

  • SSDEEP

    6144:ex8FPmWqwcz68XkgP+iVW8g/UcFqPm0iXc5n4MEP5:xqw4jGihwZnLXc5nxEP5

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

94.49.254.194:80

212.51.142.238:8080

91.231.166.124:8080

162.241.92.219:8080

79.98.24.39:8080

109.117.53.230:443

78.189.165.52:8080

113.160.130.116:8443

121.124.124.40:7080

101.187.97.173:80

168.235.67.138:7080

104.131.44.150:8080

5.39.91.110:7080

139.59.60.244:8080

81.2.235.111:8080

116.203.32.252:8080

61.19.246.238:443

176.111.60.55:8080

190.55.181.54:443

108.48.41.69:80

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet payload 3 IoCs

    Detects Emotet payload in memory.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6e8e0f107d9054863a4ce11311a4ce6a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6e8e0f107d9054863a4ce11311a4ce6a_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2876

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2876-0-0x00000000022E0000-0x00000000022EC000-memory.dmp

    Filesize

    48KB

  • memory/2876-4-0x00000000022D0000-0x00000000022D9000-memory.dmp

    Filesize

    36KB

  • memory/2876-5-0x00000000022E0000-0x00000000022EC000-memory.dmp

    Filesize

    48KB

  • memory/2876-6-0x0000000002570000-0x0000000002661000-memory.dmp

    Filesize

    964KB