Analysis

  • max time kernel
    133s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    25/09/2024, 07:30 UTC

General

  • Target

    f58070f23dc5739c4014582958f4945f_JaffaCakes118.exe

  • Size

    448KB

  • MD5

    f58070f23dc5739c4014582958f4945f

  • SHA1

    14d93aecba4d7138932fb3b83c96b0331360556b

  • SHA256

    785dff853ab02ca61a69a4b7653c1cd2659092b4ff5ae0c3883033cf70618544

  • SHA512

    9925590adb62c34b5817c257e85cbc0fb2f2b44889cb4517279e13b43b6bf644f394e7503cd041a8dab52992710cccbc9739c9a5fd4b75eb7fcf594b20fae5d2

  • SSDEEP

    12288:OfzaBuiszJbE9mO4sl9kVlAOyQkNvOzxMrB:ObMmO4sl9sR2Otq

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

75.139.38.211:80

69.30.203.214:8080

67.205.85.243:8080

190.160.53.126:80

183.101.175.193:80

137.59.187.107:8080

168.235.67.138:7080

209.143.35.232:80

180.92.239.110:8080

167.86.90.214:8080

85.66.181.138:80

95.213.236.64:8080

83.169.36.251:8080

157.245.99.39:8080

79.98.24.39:8080

70.167.215.250:8080

93.51.50.171:8080

174.102.48.180:80

24.179.13.119:80

41.60.200.34:80

rsa_pubkey.plain
1
-----BEGIN PUBLIC KEY-----
2
MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhANQOcBKvh5xEW7VcJ9totsjdBwuAclxS
3
Q0e09fk8V053lktpW3TRrzAW63yt6j1KWnyxMrU3igFXypBoI4lVNmkje4UPtIIS
4
fkzjEIvG1v/ZNn1k0J0PfFTxbFFeUEs3AwIDAQAB
5
-----END PUBLIC KEY-----

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet payload 3 IoCs

    Detects Emotet payload in memory.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f58070f23dc5739c4014582958f4945f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f58070f23dc5739c4014582958f4945f_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2472

Network

    No results found
  • 75.139.38.211:80
    f58070f23dc5739c4014582958f4945f_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 75.139.38.211:80
    f58070f23dc5739c4014582958f4945f_JaffaCakes118.exe
    152 B
    120 B
    3
    3
  • 69.30.203.214:8080
    f58070f23dc5739c4014582958f4945f_JaffaCakes118.exe
    152 B
    3
  • 69.30.203.214:8080
    f58070f23dc5739c4014582958f4945f_JaffaCakes118.exe
    152 B
    3
  • 67.205.85.243:8080
    f58070f23dc5739c4014582958f4945f_JaffaCakes118.exe
    152 B
    3
  • 67.205.85.243:8080
    f58070f23dc5739c4014582958f4945f_JaffaCakes118.exe
    152 B
    3
  • 190.160.53.126:80
    f58070f23dc5739c4014582958f4945f_JaffaCakes118.exe
    152 B
    3
  • 190.160.53.126:80
    f58070f23dc5739c4014582958f4945f_JaffaCakes118.exe
    152 B
    3
No results found

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2472-5-0x0000000000350000-0x000000000035C000-memory.dmp

    Filesize

    48KB

  • memory/2472-4-0x0000000000340000-0x0000000000349000-memory.dmp

    Filesize

    36KB

  • memory/2472-0-0x0000000000350000-0x000000000035C000-memory.dmp

    Filesize

    48KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.