Analysis

  • max time kernel
    133s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13-09-2024 07:23

General

  • Target

    ddf26d85ea84774299384e4380314b3b_JaffaCakes118.exe

  • Size

    150KB

  • MD5

    ddf26d85ea84774299384e4380314b3b

  • SHA1

    25ecbf71c6cd6b4fdcabc01254611d676e93e9af

  • SHA256

    9dec58b92925e2caec6199e8a6bf03ce5f0301c0c05a759a1125eb636b6b8059

  • SHA512

    1f30ddc0bcf017c05bec95ab2c76da90e5ea6032d1f884a1a50e0d9aa65a3da942d4bd2b4bd04c27648b5008464e3a3b5cc09fc737d9696eed017cf2f2a87ed3

  • SSDEEP

    3072:27wk52aD1O/3sc6OtoCiQLn6DYW8W9RVBHniL9X+f:27lDo/H6XCicn69RVBHi

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

49.243.9.118:80

167.71.227.113:8080

190.85.46.52:7080

162.144.42.60:8080

86.57.216.23:80

202.166.170.43:80

118.243.83.70:80

36.91.44.183:80

118.33.121.37:80

116.202.10.123:8080

113.193.239.51:443

169.1.211.133:80

192.163.221.191:8080

115.79.59.157:80

51.38.201.19:7080

45.177.120.37:8080

190.194.12.132:80

185.80.172.199:80

128.106.187.110:80

73.55.128.120:80

rsa_pubkey.plain
1
-----BEGIN PUBLIC KEY-----
2
MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAM/TXLLvX91I6dVMYe+T1PPO6mpcg7OJ
3
cMl9o/g4nUhZOp8fAAmQl8XMXeGvDhZXTyX1AXf401iPFui0RB6glhl/7/djvi7j
4
l32lAhyBANpKGty8xf3J5kGwwClnG/CXHQIDAQAB
5
-----END PUBLIC KEY-----

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet payload 3 IoCs

    Detects Emotet payload in memory.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ddf26d85ea84774299384e4380314b3b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ddf26d85ea84774299384e4380314b3b_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:1908

Network

    No results found
  • 49.243.9.118:80
    ddf26d85ea84774299384e4380314b3b_JaffaCakes118.exe
    152 B
    3
  • 49.243.9.118:80
    ddf26d85ea84774299384e4380314b3b_JaffaCakes118.exe
    152 B
    3
  • 167.71.227.113:8080
    ddf26d85ea84774299384e4380314b3b_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 167.71.227.113:8080
    ddf26d85ea84774299384e4380314b3b_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 190.85.46.52:7080
    ddf26d85ea84774299384e4380314b3b_JaffaCakes118.exe
    152 B
    3
  • 190.85.46.52:7080
    ddf26d85ea84774299384e4380314b3b_JaffaCakes118.exe
    152 B
    3
  • 162.144.42.60:8080
    ddf26d85ea84774299384e4380314b3b_JaffaCakes118.exe
    152 B
    3
  • 162.144.42.60:8080
    ddf26d85ea84774299384e4380314b3b_JaffaCakes118.exe
    152 B
    3
No results found

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1908-4-0x0000000000030000-0x0000000000040000-memory.dmp

    Filesize

    64KB

  • memory/1908-7-0x0000000000020000-0x000000000002F000-memory.dmp

    Filesize

    60KB

  • memory/1908-0-0x0000000000230000-0x0000000000242000-memory.dmp

    Filesize

    72KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.