emotet | 2f463a5bfd54fe76996dcf1f44ae8e7d3a9fa9ef131cc5c84e12b9a42b11a3e1

Analysis

max time kernel
136s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 15:01 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa9f08af5e16dc852353a906f0b0300e_JaffaCakes118.exe
Size

160KB
MD5

fa9f08af5e16dc852353a906f0b0300e
SHA1

649ca65b54bde42032e5ecf7b7aabfd1ce3dc343
SHA256

2f463a5bfd54fe76996dcf1f44ae8e7d3a9fa9ef131cc5c84e12b9a42b11a3e1
SHA512

b778f20dd384d00ee41eeceaa5535d63d7dda9dc9f59e7fedf897f7c724d4399a0bb00d81c7ceca30c6ee28e8da4dbf66f9e7247ece4ac57b07e79a17c8fdd21
SSDEEP

3072:tDZrsQCjgM9m5r/wIpmmOfr7xYZiomAiC:vQtjgB/wIp9GaSA

Score

10^/10

emotet epoch3 banker discovery trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

49.243.9.118:80

167.71.227.113:8080

190.85.46.52:7080

162.144.42.60:8080

86.57.216.23:80

202.166.170.43:80

118.243.83.70:80

36.91.44.183:80

118.33.121.37:80

116.202.10.123:8080

113.193.239.51:443

169.1.211.133:80

192.163.221.191:8080

115.79.59.157:80

51.38.201.19:7080

45.177.120.37:8080

190.194.12.132:80

185.80.172.199:80

128.106.187.110:80

73.55.128.120:80

rsa_pubkey.plain

1
-----BEGIN PUBLIC KEY-----
2
MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAM/TXLLvX91I6dVMYe+T1PPO6mpcg7OJ
3
cMl9o/g4nUhZOp8fAAmQl8XMXeGvDhZXTyX1AXf401iPFui0RB6glhl/7/djvi7j
4
l32lAhyBANpKGty8xf3J5kGwwClnG/CXHQIDAQAB
5
-----END PUBLIC KEY-----

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet payload 3 IoCs

Detects Emotet payload in memory.

trojan banker

resource	yara_rule
behavioral2/memory/2888-4-0x00000000006C0000-0x00000000006D0000-memory.dmp	emotet
behavioral2/memory/2888-7-0x0000000000580000-0x000000000058F000-memory.dmp	emotet
behavioral2/memory/2888-0-0x0000000000590000-0x00000000005A2000-memory.dmp	emotet

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fa9f08af5e16dc852353a906f0b0300e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2888	fa9f08af5e16dc852353a906f0b0300e_JaffaCakes118.exe
2888	fa9f08af5e16dc852353a906f0b0300e_JaffaCakes118.exe
2888	fa9f08af5e16dc852353a906f0b0300e_JaffaCakes118.exe
2888	fa9f08af5e16dc852353a906f0b0300e_JaffaCakes118.exe
2888	fa9f08af5e16dc852353a906f0b0300e_JaffaCakes118.exe
2888	fa9f08af5e16dc852353a906f0b0300e_JaffaCakes118.exe
2888	fa9f08af5e16dc852353a906f0b0300e_JaffaCakes118.exe
2888	fa9f08af5e16dc852353a906f0b0300e_JaffaCakes118.exe
2888	fa9f08af5e16dc852353a906f0b0300e_JaffaCakes118.exe
2888	fa9f08af5e16dc852353a906f0b0300e_JaffaCakes118.exe
2888	fa9f08af5e16dc852353a906f0b0300e_JaffaCakes118.exe
2888	fa9f08af5e16dc852353a906f0b0300e_JaffaCakes118.exe
2888	fa9f08af5e16dc852353a906f0b0300e_JaffaCakes118.exe
2888	fa9f08af5e16dc852353a906f0b0300e_JaffaCakes118.exe
2888	fa9f08af5e16dc852353a906f0b0300e_JaffaCakes118.exe
2888	fa9f08af5e16dc852353a906f0b0300e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fa9f08af5e16dc852353a906f0b0300e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fa9f08af5e16dc852353a906f0b0300e_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2888

Network

DNS

228.249.119.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

228.249.119.40.in-addr.arpa

IN PTR

Response
DNS

79.190.18.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

79.190.18.2.in-addr.arpa

IN PTR

Response

79.190.18.2.in-addr.arpa

IN PTR

a2-18-190-79deploystaticakamaitechnologiescom
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

64.159.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

64.159.190.20.in-addr.arpa

IN PTR

Response
DNS

196.249.167.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

196.249.167.52.in-addr.arpa

IN PTR

Response
DNS

28.118.140.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

28.118.140.52.in-addr.arpa

IN PTR

Response
DNS

197.87.175.4.in-addr.arpa

Remote address:

8.8.8.8:53

Request

197.87.175.4.in-addr.arpa

IN PTR

Response
DNS

18.31.95.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

18.31.95.13.in-addr.arpa

IN PTR

Response
DNS

75.117.19.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

75.117.19.2.in-addr.arpa

IN PTR

Response

75.117.19.2.in-addr.arpa

IN PTR

a2-19-117-75deploystaticakamaitechnologiescom
DNS

101.210.23.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

101.210.23.2.in-addr.arpa

IN PTR

Response

101.210.23.2.in-addr.arpa

IN PTR

a2-23-210-101deploystaticakamaitechnologiescom
DNS

13.227.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

13.227.111.52.in-addr.arpa

IN PTR

Response

49.243.9.118:80

fa9f08af5e16dc852353a906f0b0300e_JaffaCakes118.exe

260 B
5
167.71.227.113:8080

fa9f08af5e16dc852353a906f0b0300e_JaffaCakes118.exe

260 B
200 B
5
5
190.85.46.52:7080

fa9f08af5e16dc852353a906f0b0300e_JaffaCakes118.exe

260 B
5
162.144.42.60:8080

fa9f08af5e16dc852353a906f0b0300e_JaffaCakes118.exe

260 B
5
86.57.216.23:80

fa9f08af5e16dc852353a906f0b0300e_JaffaCakes118.exe

260 B
5
202.166.170.43:80

fa9f08af5e16dc852353a906f0b0300e_JaffaCakes118.exe

260 B
5
118.243.83.70:80

fa9f08af5e16dc852353a906f0b0300e_JaffaCakes118.exe

208 B
4

8.8.8.8:53

228.249.119.40.in-addr.arpa

dns

73 B
159 B
1
1

DNS Request

228.249.119.40.in-addr.arpa
8.8.8.8:53

79.190.18.2.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

79.190.18.2.in-addr.arpa
8.8.8.8:53

64.159.190.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

64.159.190.20.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

196.249.167.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

196.249.167.52.in-addr.arpa
8.8.8.8:53

28.118.140.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

28.118.140.52.in-addr.arpa
8.8.8.8:53

197.87.175.4.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

197.87.175.4.in-addr.arpa
8.8.8.8:53

18.31.95.13.in-addr.arpa

dns

70 B
144 B
1
1

DNS Request

18.31.95.13.in-addr.arpa
8.8.8.8:53

75.117.19.2.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

75.117.19.2.in-addr.arpa
8.8.8.8:53

101.210.23.2.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

101.210.23.2.in-addr.arpa
8.8.8.8:53

13.227.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

13.227.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2888-4-0x00000000006C0000-0x00000000006D0000-memory.dmp

Filesize
64KB

Download
memory/2888-7-0x0000000000580000-0x000000000058F000-memory.dmp

Filesize
60KB

Download
memory/2888-0-0x0000000000590000-0x00000000005A2000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.