Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
31-07-2024 13:30
Static task
static1
Behavioral task
behavioral1
Sample
7c9a1bbf8330c6952a71d7656877908d_JaffaCakes118.dll
Resource
win7-20240705-en
General
-
Target
7c9a1bbf8330c6952a71d7656877908d_JaffaCakes118.dll
-
Size
340KB
-
MD5
7c9a1bbf8330c6952a71d7656877908d
-
SHA1
e9b2d5f9a13dd288e6f58d78cbab9fc554a615b7
-
SHA256
979d7e5624aff3fe7488779f1bbabd74fc97cdb8cf12aba3d36144e4a7941b16
-
SHA512
1b1f9db762f2808aead0083857dded48bb18ec76c5eecc3f61dba887b0b346463541716575f3b82f3a3f80f7c778c412f33094b66d4fdd8cdc8e572876f0ca4d
-
SSDEEP
3072:cvA1p08RqEQAIVEd2gG/vNlo0JFx/pANyCm0PQEKR/JnXHWP:c206xWgGxLxWN40PDKR/JnX2P
Malware Config
Extracted
emotet
Epoch2
69.38.130.14:80
195.159.28.230:8080
162.241.204.233:8080
115.21.224.117:80
78.189.148.42:80
181.165.68.127:80
78.188.225.105:80
161.0.153.60:80
89.106.251.163:80
172.125.40.123:80
5.39.91.110:7080
110.145.11.73:80
190.251.200.206:80
144.217.7.207:7080
75.109.111.18:80
75.177.207.146:80
139.59.60.244:8080
70.183.211.3:80
95.213.236.64:8080
61.19.246.238:443
174.118.202.24:443
71.72.196.159:80
138.68.87.218:443
24.164.79.147:8080
49.205.182.134:80
24.231.88.85:80
121.124.124.40:7080
95.9.5.93:80
118.83.154.64:443
78.24.219.147:8080
104.131.11.150:443
85.105.205.77:8080
108.53.88.101:443
187.161.206.24:80
203.153.216.189:7080
37.187.72.193:8080
185.94.252.104:443
157.245.99.39:8080
50.91.114.38:80
87.106.139.101:8080
74.128.121.17:80
62.75.141.82:80
37.139.21.175:8080
190.103.228.24:80
134.209.144.106:443
78.182.254.231:80
186.74.215.34:80
180.222.161.85:80
69.49.88.46:80
202.134.4.211:8080
75.113.193.72:80
139.162.60.124:8080
79.137.83.50:443
123.176.25.234:80
172.105.13.66:443
93.146.48.84:80
109.116.245.80:80
41.185.28.84:8080
98.109.133.80:80
194.190.67.75:80
110.145.101.66:443
136.244.110.184:8080
24.179.13.119:80
89.216.122.92:80
139.99.158.11:443
172.86.188.251:8080
74.40.205.197:443
62.171.142.179:8080
167.114.153.111:8080
119.59.116.21:8080
74.58.215.226:80
188.165.214.98:8080
172.104.97.173:8080
197.211.245.21:80
66.57.108.14:443
188.219.31.12:80
168.235.67.138:7080
24.69.65.8:8080
173.70.61.180:80
110.142.236.207:80
51.89.36.180:443
46.105.131.79:8080
194.4.58.192:7080
220.245.198.194:80
109.74.5.95:8080
24.178.90.49:80
181.171.209.241:443
59.21.235.119:80
94.23.237.171:443
12.175.220.98:80
217.20.166.178:7080
50.116.111.59:8080
176.111.60.55:8080
200.116.145.225:443
120.150.60.189:80
185.201.9.197:8080
202.134.4.216:8080
120.150.218.241:443
2.58.16.89:8080
70.92.118.112:80
74.208.45.104:8080
79.130.130.240:8080
190.240.194.77:443
85.105.111.166:80
115.94.207.99:443
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2888 rundll32.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Pfygiovnkhfczk\hzrqytdjgbgoh.gou rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1372 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3056 wrote to memory of 1372 3056 rundll32.exe 83 PID 3056 wrote to memory of 1372 3056 rundll32.exe 83 PID 3056 wrote to memory of 1372 3056 rundll32.exe 83 PID 1372 wrote to memory of 2888 1372 rundll32.exe 90 PID 1372 wrote to memory of 2888 1372 rundll32.exe 90 PID 1372 wrote to memory of 2888 1372 rundll32.exe 90
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7c9a1bbf8330c6952a71d7656877908d_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7c9a1bbf8330c6952a71d7656877908d_JaffaCakes118.dll,#12⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Pfygiovnkhfczk\hzrqytdjgbgoh.gou",LnMUG3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2888
-
-
Network
-
Remote address:8.8.8.8:53Request6.181.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request205.47.74.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request103.169.127.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request147.142.123.92.in-addr.arpaIN PTRResponse147.142.123.92.in-addr.arpaIN PTRa92-123-142-147deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request81.144.22.2.in-addr.arpaIN PTRResponse81.144.22.2.in-addr.arpaIN PTRa2-22-144-81deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request19.229.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request19.229.111.52.in-addr.arpaIN PTR
-
71 B 157 B 1 1
DNS Request
6.181.190.20.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
205.47.74.20.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
103.169.127.40.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
171.39.242.20.in-addr.arpa
-
73 B 139 B 1 1
DNS Request
147.142.123.92.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
81.144.22.2.in-addr.arpa
-
144 B 158 B 2 1
DNS Request
19.229.111.52.in-addr.arpa
DNS Request
19.229.111.52.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
340KB
MD57c9a1bbf8330c6952a71d7656877908d
SHA1e9b2d5f9a13dd288e6f58d78cbab9fc554a615b7
SHA256979d7e5624aff3fe7488779f1bbabd74fc97cdb8cf12aba3d36144e4a7941b16
SHA5121b1f9db762f2808aead0083857dded48bb18ec76c5eecc3f61dba887b0b346463541716575f3b82f3a3f80f7c778c412f33094b66d4fdd8cdc8e572876f0ca4d