Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19-09-2024 23:43

General

  • Target

    ec6a39afc972c955963b960d1c5c2a24_JaffaCakes118.exe

  • Size

    668KB

  • MD5

    ec6a39afc972c955963b960d1c5c2a24

  • SHA1

    e2772dc109d77d386d482dbce3f12eb5957c8d2b

  • SHA256

    a5f25362adcaa442478aadb03e487772f8daafc4c43bbc3859c15623f5221f44

  • SHA512

    75fbb1f516ada3a0055993fa063eef4ccdbf7f033a951d627c686d1598314abd3cae01708c18de9c63f70d6ad9395f52c5d65b71d9eb067eb78c10e6f2959ad9

  • SSDEEP

    6144:gdiE4zqXVY7PfBHnzA0F3JhJx4eS5tNMTy5fkLaMiLgLWL7SqaaYo5wzPLNQOIeG:gdw7hHnzAe3oe6tZ6zEPaexL62

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

202.22.141.45:80

37.187.161.206:8080

202.29.239.162:443

80.87.201.221:7080

82.76.111.249:443

216.47.196.104:80

192.241.143.52:8080

192.81.38.31:80

87.106.253.248:8080

64.201.88.132:80

192.241.146.84:8080

12.162.84.2:8080

1.226.84.243:8080

177.129.17.170:443

202.134.4.210:7080

70.169.17.134:80

152.169.22.67:80

5.196.35.138:7080

138.97.60.141:7080

203.205.28.68:80

rsa_pubkey.plain
1
-----BEGIN PUBLIC KEY-----
2
MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAOZ9fLJ8UrI0OZURpPsR3eijAyfPj3z6
3
uS75f2igmYFW2aWgNcFIzsAYQleKzD0nlCFHOo7Zf8/4wY2UW0CJ4dJEHnE/PHlz
4
6uNk3pxjm7o4eCDyiJbzf+k0Azjl0q54FQIDAQAB
5
-----END PUBLIC KEY-----

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet payload 3 IoCs

    Detects Emotet payload in memory.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ec6a39afc972c955963b960d1c5c2a24_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ec6a39afc972c955963b960d1c5c2a24_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:588

Network

    No results found
  • 202.22.141.45:80
    ec6a39afc972c955963b960d1c5c2a24_JaffaCakes118.exe
    152 B
    3
  • 202.22.141.45:80
    ec6a39afc972c955963b960d1c5c2a24_JaffaCakes118.exe
    152 B
    3
  • 37.187.161.206:8080
    ec6a39afc972c955963b960d1c5c2a24_JaffaCakes118.exe
    152 B
    3
  • 37.187.161.206:8080
    ec6a39afc972c955963b960d1c5c2a24_JaffaCakes118.exe
    152 B
    3
  • 202.29.239.162:443
    ec6a39afc972c955963b960d1c5c2a24_JaffaCakes118.exe
    152 B
    3
  • 202.29.239.162:443
    ec6a39afc972c955963b960d1c5c2a24_JaffaCakes118.exe
    152 B
    3
No results found

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/588-7-0x0000000000280000-0x000000000028F000-memory.dmp

    Filesize

    60KB

  • memory/588-4-0x00000000003B0000-0x00000000003C0000-memory.dmp

    Filesize

    64KB

  • memory/588-0-0x0000000000390000-0x00000000003A2000-memory.dmp

    Filesize

    72KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.