Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-09-2024 19:08

General

  • Target

    e56bc5b4d75edb4fc828e96295ed7393_JaffaCakes118.exe

  • Size

    267KB

  • MD5

    e56bc5b4d75edb4fc828e96295ed7393

  • SHA1

    e80f5d5b4c5ba6c56ae4a984d9c2c7ca83ddef26

  • SHA256

    49c7a0dc3be0defefcc2b1a0ca5b30a3365434cd018973c076af69e953f41d9c

  • SHA512

    2f85af18a060f9540c5430dadb5beb04b3df72f7d9589dc7861a3c23da5ab3f121432e5265e9b70535a007d5b967ff4164a70b97cb7c75adbc187adea3448688

  • SSDEEP

    6144:ed8GfgPu1jnIm2rJ3Rbn7lqCc1dLe0XYg27TyOJWmaTlBcdpPk+UyY:ed8o1jCIXLe0P2ndWzlfD

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

172.104.233.225:8080

70.32.78.99:8080

213.189.36.51:8080

107.170.27.84:443

181.135.153.203:443

94.183.71.206:7080

87.118.70.69:8080

69.163.33.84:8080

86.42.166.147:80

181.16.17.210:443

111.119.233.65:80

81.169.140.14:443

119.59.124.163:8080

186.15.83.52:8080

163.172.40.218:7080

62.75.143.100:7080

181.91.215.151:990

5.196.35.138:7080

14.160.93.230:80

68.183.190.199:8080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e56bc5b4d75edb4fc828e96295ed7393_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e56bc5b4d75edb4fc828e96295ed7393_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2672
    • C:\Users\Admin\AppData\Local\Temp\e56bc5b4d75edb4fc828e96295ed7393_JaffaCakes118.exe
      --1122cc3b
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      PID:788
  • C:\Windows\SysWOW64\sensorfill.exe
    "C:\Windows\SysWOW64\sensorfill.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4408
    • C:\Windows\SysWOW64\sensorfill.exe
      --56baf68f
      2⤵
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      PID:3160

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\e33aec243fbda420976c3735c1f68a0d_c186ecc3-67e4-4d2b-8682-b6c322da87aa

    Filesize

    50B

    MD5

    d3b2072f22c54a987baf5b09bc63a002

    SHA1

    e405a097074ca95e27198f3f5279be9aa01536ff

    SHA256

    c6af0c5856ec37ae236b3086cae6caeba8b637db0144d3581d53cf65cf5013e8

    SHA512

    d76f5e53fc0568ec48fb67ae02974fb9832e821a34683f56348c15aeaaf3a03312e3fa2e27579ac94145967ae221c2dc8e322ce0fe3c4d9242505b44c05ddbdf

  • memory/788-7-0x0000000000940000-0x0000000000957000-memory.dmp

    Filesize

    92KB

  • memory/788-19-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/2672-0-0x00000000025D0000-0x00000000025E7000-memory.dmp

    Filesize

    92KB

  • memory/2672-5-0x00000000009A0000-0x00000000009B1000-memory.dmp

    Filesize

    68KB

  • memory/2672-6-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/3160-21-0x00000000007C0000-0x00000000007D7000-memory.dmp

    Filesize

    92KB

  • memory/3160-26-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/4408-14-0x00000000001D0000-0x00000000001E7000-memory.dmp

    Filesize

    92KB

  • memory/4408-18-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB