Analysis

  • max time kernel
    129s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20-09-2024 17:23

General

  • Target

    ee13e708610de128bccf4ee2195d43bf_JaffaCakes118.exe

  • Size

    172KB

  • MD5

    ee13e708610de128bccf4ee2195d43bf

  • SHA1

    7f878d7bdc161bd3e5ebaf6517c61655101c3c28

  • SHA256

    ecb519133ab720d38918ea55db042e74f9ce2e7fff0d37e0c606f014af532a9d

  • SHA512

    1be3a688b7375dd88a246f518fc4dc3be51c63ef896ebc3d8f43cdad3bda2a7738392716d67fde1807a241c51e4566b167fbf99be7be47a5cceb1506a62e646c

  • SSDEEP

    1536:SvrrLwNwO6kX8CsVTC/8z/20X6AV8EiOpOACFsyfP292RiWV0IFT5mDzsoErpYj/:irLs9sL9C/sjzTT/shO9wT3F96OvOQ6

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

82.230.1.24:80

51.38.124.206:80

82.196.15.205:8080

38.88.126.202:8080

61.197.92.216:80

217.199.160.224:7080

61.92.159.208:8080

186.103.141.250:443

104.131.41.185:8080

170.81.48.2:80

50.121.220.50:80

190.195.129.227:8090

187.162.248.237:80

172.104.169.32:8080

199.203.62.165:80

45.161.242.102:80

45.46.37.97:80

96.227.52.8:443

65.36.62.20:80

220.109.145.69:80

rsa_pubkey.plain
1
-----BEGIN PUBLIC KEY-----
2
MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAOZ9fLJ8UrI0OZURpPsR3eijAyfPj3z6
3
uS75f2igmYFW2aWgNcFIzsAYQleKzD0nlCFHOo7Zf8/4wY2UW0CJ4dJEHnE/PHlz
4
6uNk3pxjm7o4eCDyiJbzf+k0Azjl0q54FQIDAQAB
5
-----END PUBLIC KEY-----

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet payload 3 IoCs

    Detects Emotet payload in memory.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ee13e708610de128bccf4ee2195d43bf_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ee13e708610de128bccf4ee2195d43bf_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:320

Network

  • flag-de
    POST
    http://51.38.124.206/w5ZMcdUOPnJiwV7nD/3LvxuorbW/iGzFDfX4tGj9jFz/mcKutxH9R/
    ee13e708610de128bccf4ee2195d43bf_JaffaCakes118.exe
    Remote address:
    51.38.124.206:80
    Request
    POST /w5ZMcdUOPnJiwV7nD/3LvxuorbW/iGzFDfX4tGj9jFz/mcKutxH9R/ HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate
    DNT: 1
    Connection: keep-alive
    Referer: 51.38.124.206/w5ZMcdUOPnJiwV7nD/3LvxuorbW/iGzFDfX4tGj9jFz/mcKutxH9R/
    Upgrade-Insecure-Requests: 1
    Content-Type: multipart/form-data; boundary=---------------------44niT58XICpZGhiWmc6Hx
    Host: 51.38.124.206
    Content-Length: 4420
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Fri, 20 Sep 2024 17:24:27 GMT
    Server: Apache/2.4.52 (Ubuntu)
    Content-Length: 275
    Keep-Alive: timeout=5, max=100
    Connection: Keep-Alive
    Content-Type: text/html; charset=iso-8859-1
  • 82.230.1.24:80
    ee13e708610de128bccf4ee2195d43bf_JaffaCakes118.exe
    152 B
    3
  • 82.230.1.24:80
    ee13e708610de128bccf4ee2195d43bf_JaffaCakes118.exe
    152 B
    3
  • 51.38.124.206:80
    http://51.38.124.206/w5ZMcdUOPnJiwV7nD/3LvxuorbW/iGzFDfX4tGj9jFz/mcKutxH9R/
    http
    ee13e708610de128bccf4ee2195d43bf_JaffaCakes118.exe
    5.7kB
    784 B
    16
    7

    HTTP Request

    POST http://51.38.124.206/w5ZMcdUOPnJiwV7nD/3LvxuorbW/iGzFDfX4tGj9jFz/mcKutxH9R/

    HTTP Response

    404
  • 82.196.15.205:8080
    ee13e708610de128bccf4ee2195d43bf_JaffaCakes118.exe
    152 B
    3
  • 82.196.15.205:8080
    ee13e708610de128bccf4ee2195d43bf_JaffaCakes118.exe
    152 B
    3
  • 38.88.126.202:8080
    ee13e708610de128bccf4ee2195d43bf_JaffaCakes118.exe
    152 B
    3
  • 38.88.126.202:8080
    ee13e708610de128bccf4ee2195d43bf_JaffaCakes118.exe
    152 B
    3
No results found

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/320-7-0x00000000002E0000-0x00000000002EF000-memory.dmp

    Filesize

    60KB

  • memory/320-4-0x00000000003A0000-0x00000000003B0000-memory.dmp

    Filesize

    64KB

  • memory/320-0-0x00000000002F0000-0x0000000000302000-memory.dmp

    Filesize

    72KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.