Analysis

  • max time kernel
    133s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21-09-2024 04:26

General

  • Target

    ef109f428ab1a7cf6ac503f1d2dc0b79_JaffaCakes118.exe

  • Size

    152KB

  • MD5

    ef109f428ab1a7cf6ac503f1d2dc0b79

  • SHA1

    47014c10c1e31b96f33bca32a3e76a659894c697

  • SHA256

    819b058f2aae2f87b4477b3570b8330554fb1ad221d89a019ea32083cd9ca118

  • SHA512

    9c1a05d48a48a0f3e6f8ab0e55bc1c5250b0346c9fbdd9008c678b900b9c76390fc5f040d1c0e8f76497ec21d3f3f5bd6137f63b7140749c089ff5935d52a422

  • SSDEEP

    3072:/t0kQHEE+CXFaWo/clgQ0S7kNNcaxVTOVi6WXJs+u:wENVWGBS7qcaxKizG

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

76.168.54.203:80

51.38.124.206:80

38.88.126.202:8080

54.37.42.48:8080

5.196.35.138:7080

177.129.17.170:443

87.106.46.107:8080

68.183.190.199:8080

185.183.16.47:80

186.103.141.250:443

64.201.88.132:80

70.32.84.74:8080

68.69.155.181:80

82.76.111.249:443

111.67.12.221:8080

60.93.23.51:80

104.131.41.185:8080

92.24.50.153:80

191.182.6.118:80

61.197.92.216:80

rsa_pubkey.plain
1
-----BEGIN PUBLIC KEY-----
2
MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAOZ9fLJ8UrI0OZURpPsR3eijAyfPj3z6
3
uS75f2igmYFW2aWgNcFIzsAYQleKzD0nlCFHOo7Zf8/4wY2UW0CJ4dJEHnE/PHlz
4
6uNk3pxjm7o4eCDyiJbzf+k0Azjl0q54FQIDAQAB
5
-----END PUBLIC KEY-----

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet payload 3 IoCs

    Detects Emotet payload in memory.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ef109f428ab1a7cf6ac503f1d2dc0b79_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ef109f428ab1a7cf6ac503f1d2dc0b79_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:1828

Network

  • flag-de
    POST
    http://51.38.124.206/bJWNOnVyQhSSOK/OgOosy9/XHmaJkh4xiXSd/
    ef109f428ab1a7cf6ac503f1d2dc0b79_JaffaCakes118.exe
    Remote address:
    51.38.124.206:80
    Request
    POST /bJWNOnVyQhSSOK/OgOosy9/XHmaJkh4xiXSd/ HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate
    DNT: 1
    Connection: keep-alive
    Referer: 51.38.124.206/bJWNOnVyQhSSOK/OgOosy9/XHmaJkh4xiXSd/
    Upgrade-Insecure-Requests: 1
    Content-Type: multipart/form-data; boundary=------------------nfe2HwzfiIxYoyErVQ
    Host: 51.38.124.206
    Content-Length: 4420
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Sat, 21 Sep 2024 04:27:49 GMT
    Server: Apache/2.4.52 (Ubuntu)
    Content-Length: 275
    Keep-Alive: timeout=5, max=100
    Connection: Keep-Alive
    Content-Type: text/html; charset=iso-8859-1
  • 76.168.54.203:80
    ef109f428ab1a7cf6ac503f1d2dc0b79_JaffaCakes118.exe
    152 B
    3
  • 76.168.54.203:80
    ef109f428ab1a7cf6ac503f1d2dc0b79_JaffaCakes118.exe
    152 B
    3
  • 51.38.124.206:80
    http://51.38.124.206/bJWNOnVyQhSSOK/OgOosy9/XHmaJkh4xiXSd/
    http
    ef109f428ab1a7cf6ac503f1d2dc0b79_JaffaCakes118.exe
    5.7kB
    824 B
    16
    8

    HTTP Request

    POST http://51.38.124.206/bJWNOnVyQhSSOK/OgOosy9/XHmaJkh4xiXSd/

    HTTP Response

    404
  • 38.88.126.202:8080
    ef109f428ab1a7cf6ac503f1d2dc0b79_JaffaCakes118.exe
    152 B
    3
  • 38.88.126.202:8080
    ef109f428ab1a7cf6ac503f1d2dc0b79_JaffaCakes118.exe
    152 B
    3
  • 54.37.42.48:8080
    ef109f428ab1a7cf6ac503f1d2dc0b79_JaffaCakes118.exe
    152 B
    3
  • 54.37.42.48:8080
    ef109f428ab1a7cf6ac503f1d2dc0b79_JaffaCakes118.exe
    152 B
    3
No results found

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1828-7-0x00000000001B0000-0x00000000001BF000-memory.dmp

    Filesize

    60KB

  • memory/1828-4-0x00000000001C0000-0x00000000001D0000-memory.dmp

    Filesize

    64KB

  • memory/1828-0-0x00000000001E0000-0x00000000001F2000-memory.dmp

    Filesize

    72KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.