Analysis

  • max time kernel
    134s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    25-09-2024 19:32

General

  • Target

    f6b6d360cf33e7abb35954c78a340e4f_JaffaCakes118.exe

  • Size

    400KB

  • MD5

    f6b6d360cf33e7abb35954c78a340e4f

  • SHA1

    01fb0134bab772390edb8bea3cc8d5a002524b92

  • SHA256

    40dbcbd5a25cc2bfa158ec88ce8a20da179f1c07cd94a16eb633a91d71ebc766

  • SHA512

    b0ba03f8727fb57b67e20e5e98ae8954b9ffab35a4eba779eb2521f07edaf857887533af10b7a8b53abe506875953ab8f77af6d76d78616e0dc11060aebb3605

  • SSDEEP

    3072:2KQAYgKE+PP7BDV2WNbX+Ob5C7se89qjkD6Kd/Y+oQ6vDJ1EsbgKEkC66V0qzIju:cASTBDPN7+wPe8QjW64oQ6LJ1/IDc9kb

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

116.91.240.96:80

167.71.227.113:8080

190.85.46.52:7080

162.144.42.60:8080

202.166.170.43:80

95.216.205.155:8080

120.51.34.254:80

103.93.220.182:80

111.89.241.139:80

60.125.114.64:443

45.177.120.37:8080

185.86.148.68:443

75.127.14.170:8080

119.92.77.17:80

203.153.216.178:7080

172.96.190.154:8080

179.5.118.12:80

153.229.219.1:443

139.59.12.63:8080

115.79.195.246:80

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet payload 2 IoCs

    Detects Emotet payload in memory.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f6b6d360cf33e7abb35954c78a340e4f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f6b6d360cf33e7abb35954c78a340e4f_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2080

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2080-3-0x0000000000650000-0x0000000000652000-memory.dmp

    Filesize

    8KB

  • memory/2080-14-0x0000000000650000-0x0000000000652000-memory.dmp

    Filesize

    8KB

  • memory/2080-13-0x0000000000650000-0x0000000000652000-memory.dmp

    Filesize

    8KB

  • memory/2080-12-0x0000000000650000-0x0000000000652000-memory.dmp

    Filesize

    8KB

  • memory/2080-11-0x0000000000650000-0x0000000000652000-memory.dmp

    Filesize

    8KB

  • memory/2080-10-0x0000000000650000-0x0000000000652000-memory.dmp

    Filesize

    8KB

  • memory/2080-9-0x0000000000650000-0x0000000000652000-memory.dmp

    Filesize

    8KB

  • memory/2080-8-0x0000000000650000-0x0000000000652000-memory.dmp

    Filesize

    8KB

  • memory/2080-7-0x0000000000650000-0x0000000000652000-memory.dmp

    Filesize

    8KB

  • memory/2080-6-0x0000000000650000-0x0000000000652000-memory.dmp

    Filesize

    8KB

  • memory/2080-5-0x0000000000650000-0x0000000000652000-memory.dmp

    Filesize

    8KB

  • memory/2080-4-0x0000000000650000-0x0000000000652000-memory.dmp

    Filesize

    8KB

  • memory/2080-15-0x0000000000650000-0x0000000000652000-memory.dmp

    Filesize

    8KB

  • memory/2080-16-0x0000000000439000-0x000000000043A000-memory.dmp

    Filesize

    4KB

  • memory/2080-21-0x0000000000400000-0x0000000000467000-memory.dmp

    Filesize

    412KB

  • memory/2080-17-0x00000000006E0000-0x00000000006F0000-memory.dmp

    Filesize

    64KB

  • memory/2080-22-0x00000000006E0000-0x00000000006F0000-memory.dmp

    Filesize

    64KB