Analysis

  • max time kernel
    131s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    18-09-2024 08:42

General

  • Target

    e8bac5edb4fb2d03a1729e44235adbec_JaffaCakes118.exe

  • Size

    95KB

  • MD5

    e8bac5edb4fb2d03a1729e44235adbec

  • SHA1

    eb96b95fee1b18cfb910af4e8c956bf1c44b0643

  • SHA256

    1e2e27f18fd55e62b405851a31e9d4b635afbe287b416a16f92c238007dbfe2a

  • SHA512

    e6a2509d0be615eceb73555249533c56b2662ed21f33b9733bb7691caec0ef6615b401be96981df3dd73ee4ca6fa4806eec9df819bc9dcb9dda06c28b86ac560

  • SSDEEP

    1536:L4ay5eVyitXhOC2ZwmOlKOoa47iBpi9MpvmK+ES6hpFzH23FUVXm6X8:Ma+KzVsC2ZlOlKOoaaYvmK+EnNQFeX8

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

49.243.9.118:80

167.71.227.113:8080

190.85.46.52:7080

162.144.42.60:8080

86.57.216.23:80

202.166.170.43:80

118.243.83.70:80

36.91.44.183:80

118.33.121.37:80

116.202.10.123:8080

113.193.239.51:443

169.1.211.133:80

192.163.221.191:8080

115.79.59.157:80

51.38.201.19:7080

45.177.120.37:8080

190.194.12.132:80

185.80.172.199:80

128.106.187.110:80

73.55.128.120:80

rsa_pubkey.plain
1
-----BEGIN PUBLIC KEY-----
2
MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAM/TXLLvX91I6dVMYe+T1PPO6mpcg7OJ
3
cMl9o/g4nUhZOp8fAAmQl8XMXeGvDhZXTyX1AXf401iPFui0RB6glhl/7/djvi7j
4
l32lAhyBANpKGty8xf3J5kGwwClnG/CXHQIDAQAB
5
-----END PUBLIC KEY-----

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet payload 3 IoCs

    Detects Emotet payload in memory.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e8bac5edb4fb2d03a1729e44235adbec_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e8bac5edb4fb2d03a1729e44235adbec_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:2728

Network

    No results found
  • 49.243.9.118:80
    e8bac5edb4fb2d03a1729e44235adbec_JaffaCakes118.exe
    152 B
    3
  • 49.243.9.118:80
    e8bac5edb4fb2d03a1729e44235adbec_JaffaCakes118.exe
    152 B
    3
  • 167.71.227.113:8080
    e8bac5edb4fb2d03a1729e44235adbec_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 167.71.227.113:8080
    e8bac5edb4fb2d03a1729e44235adbec_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 190.85.46.52:7080
    e8bac5edb4fb2d03a1729e44235adbec_JaffaCakes118.exe
    152 B
    3
  • 190.85.46.52:7080
    e8bac5edb4fb2d03a1729e44235adbec_JaffaCakes118.exe
    152 B
    3
  • 162.144.42.60:8080
    e8bac5edb4fb2d03a1729e44235adbec_JaffaCakes118.exe
    152 B
    3
  • 162.144.42.60:8080
    e8bac5edb4fb2d03a1729e44235adbec_JaffaCakes118.exe
    152 B
    3
No results found

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2728-7-0x0000000000020000-0x000000000002F000-memory.dmp

    Filesize

    60KB

  • memory/2728-4-0x0000000000030000-0x0000000000040000-memory.dmp

    Filesize

    64KB

  • memory/2728-0-0x0000000000230000-0x0000000000242000-memory.dmp

    Filesize

    72KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.