Analysis

  • max time kernel
    130s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    26/09/2024, 04:28 UTC

General

  • Target

    f78fb05ab026d05663f89d9e18524721_JaffaCakes118.exe

  • Size

    456KB

  • MD5

    f78fb05ab026d05663f89d9e18524721

  • SHA1

    db0a0b1697598bd5ae3f08a741ac05764d276389

  • SHA256

    782a18b893d8911a76de40577ff0a720adb4c883a69b152b8324dbc8c95e99f9

  • SHA512

    a5df01930ab706eff0bdbea05cd5b27057814fd3cb6a6a0f3f1c4b5b1c650fc81a0180218d8e07785eca90139f7aab79480dec24121e92abc59d7b5820f6ef19

  • SSDEEP

    12288:+WltbWzANyY0ScqrA1lJW5FvigRlTRCH2l:nbyY0hqrA1l+TRCH2l

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

75.80.124.4:80

134.209.36.254:8080

104.156.59.7:8080

120.138.30.150:8080

107.5.122.110:80

195.251.213.56:80

91.211.88.52:7080

79.98.24.39:8080

75.139.38.211:80

82.225.49.121:80

162.241.242.173:8080

94.1.108.190:443

85.105.205.77:8080

181.169.34.190:80

24.179.13.119:80

139.59.67.118:443

82.80.155.43:80

50.91.114.38:80

93.147.212.206:80

153.232.188.106:80

rsa_pubkey.plain
1
-----BEGIN PUBLIC KEY-----
2
MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhANQOcBKvh5xEW7VcJ9totsjdBwuAclxS
3
Q0e09fk8V053lktpW3TRrzAW63yt6j1KWnyxMrU3igFXypBoI4lVNmkje4UPtIIS
4
fkzjEIvG1v/ZNn1k0J0PfFTxbFFeUEs3AwIDAQAB
5
-----END PUBLIC KEY-----

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet payload 3 IoCs

    Detects Emotet payload in memory.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f78fb05ab026d05663f89d9e18524721_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f78fb05ab026d05663f89d9e18524721_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2084

Network

    No results found
  • 75.80.124.4:80
    f78fb05ab026d05663f89d9e18524721_JaffaCakes118.exe
    152 B
    3
  • 75.80.124.4:80
    f78fb05ab026d05663f89d9e18524721_JaffaCakes118.exe
    152 B
    3
  • 134.209.36.254:8080
    f78fb05ab026d05663f89d9e18524721_JaffaCakes118.exe
    152 B
    3
  • 134.209.36.254:8080
    f78fb05ab026d05663f89d9e18524721_JaffaCakes118.exe
    152 B
    3
  • 104.156.59.7:8080
    f78fb05ab026d05663f89d9e18524721_JaffaCakes118.exe
    152 B
    3
  • 104.156.59.7:8080
    f78fb05ab026d05663f89d9e18524721_JaffaCakes118.exe
    152 B
    3
No results found

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2084-4-0x00000000003B0000-0x00000000003C0000-memory.dmp

    Filesize

    64KB

  • memory/2084-7-0x0000000000380000-0x000000000038F000-memory.dmp

    Filesize

    60KB

  • memory/2084-0-0x0000000000390000-0x00000000003A2000-memory.dmp

    Filesize

    72KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.