Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20-09-2024 21:40

General

  • Target

    ee797a190c9c95b166954948971fc01e_JaffaCakes118.exe

  • Size

    468KB

  • MD5

    ee797a190c9c95b166954948971fc01e

  • SHA1

    067d541681dfaf8e79f1a43fba411d62b80691ff

  • SHA256

    12e165728f7212a81753445d5b8b1f8724208cce4947c37cffee1720c4df9a6a

  • SHA512

    0838b4dfbaa0f866b09c9efce65f0ec387846477c5a73a61221db3268799e3d17345a435c6a643fd912f7e9598c18ef2fb954e4a8fb849d6e103195e05fc4dad

  • SSDEEP

    6144:Ba0lzIF1MpaYcN2PVgQfgfunByqVbuoMdVQjCiUUvX8HQHkd2LDEn+GfzO9+/S94:bEjMpaYk2PuUgfE7byrQjQYQ

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

98.13.75.196:80

91.121.54.71:8080

209.236.123.42:8080

89.32.150.160:8080

212.71.237.140:8080

51.255.165.160:8080

188.135.15.49:80

189.2.177.210:443

45.161.242.102:80

72.167.223.217:8080

77.238.212.227:80

186.70.127.199:8090

45.33.77.42:8080

87.106.46.107:8080

172.104.169.32:8080

187.162.248.237:80

190.163.31.26:80

95.9.180.128:80

71.197.211.156:80

91.219.169.180:80

rsa_pubkey.plain
1
-----BEGIN PUBLIC KEY-----
2
MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAOZ9fLJ8UrI0OZURpPsR3eijAyfPj3z6
3
uS75f2igmYFW2aWgNcFIzsAYQleKzD0nlCFHOo7Zf8/4wY2UW0CJ4dJEHnE/PHlz
4
6uNk3pxjm7o4eCDyiJbzf+k0Azjl0q54FQIDAQAB
5
-----END PUBLIC KEY-----

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ee797a190c9c95b166954948971fc01e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ee797a190c9c95b166954948971fc01e_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2336

Network

    No results found
  • 98.13.75.196:80
    ee797a190c9c95b166954948971fc01e_JaffaCakes118.exe
    152 B
    3
  • 98.13.75.196:80
    ee797a190c9c95b166954948971fc01e_JaffaCakes118.exe
    152 B
    3
  • 91.121.54.71:8080
    ee797a190c9c95b166954948971fc01e_JaffaCakes118.exe
    152 B
    3
  • 91.121.54.71:8080
    ee797a190c9c95b166954948971fc01e_JaffaCakes118.exe
    152 B
    3
  • 209.236.123.42:8080
    ee797a190c9c95b166954948971fc01e_JaffaCakes118.exe
    152 B
    3
  • 209.236.123.42:8080
    ee797a190c9c95b166954948971fc01e_JaffaCakes118.exe
    152 B
    3
  • 89.32.150.160:8080
    ee797a190c9c95b166954948971fc01e_JaffaCakes118.exe
    52 B
    1
No results found

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2336-1-0x0000000000330000-0x000000000033C000-memory.dmp

    Filesize

    48KB

  • memory/2336-5-0x0000000000330000-0x000000000033C000-memory.dmp

    Filesize

    48KB

  • memory/2336-0-0x0000000000260000-0x0000000000269000-memory.dmp

    Filesize

    36KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.