Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
28-09-2024 07:47
General
-
Target
fbd3b0a1c703a9fd144a6cfdedf9dcce_JaffaCakes118.exe
-
Size
244KB
-
MD5
fbd3b0a1c703a9fd144a6cfdedf9dcce
-
SHA1
9720b2ac55633721f39516d1ca25b2fb695b6479
-
SHA256
b4418c137838dc1644fd6ce1ff71e879ba5afde6ddf028a64cd17d14dd31ebf6
-
SHA512
5f0809df6cb04fdc8619b7285ee634b8159955c046161cd843ed9c29f1eca273c16c6265d20cb24bff7e936795ee82f4fa2fc7f7b5b8a627f3187b7be6540987
-
SSDEEP
1536:B1pOLlbFRiweT6woR6hLZr2lZs6H71QdlauoBQIlQIlQIlQIlQIlQIlQIlQIlQIT:BjQlpRi39Mm+sQ71QdlauoQzxHIIMzZr
Malware Config
Extracted
emotet
Epoch1
71.197.211.156:80
87.118.70.45:8080
91.121.54.71:8080
116.125.120.88:443
213.60.96.117:80
188.2.217.94:80
174.100.27.229:80
46.28.111.142:7080
186.103.141.250:443
207.144.103.227:80
110.142.219.51:80
70.32.84.74:8080
70.32.115.157:8080
111.67.12.221:8080
219.92.13.25:80
149.62.173.247:8080
177.72.13.80:80
77.238.212.227:80
5.196.35.138:7080
114.109.179.60:80
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fbd3b0a1c703a9fd144a6cfdedf9dcce_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fbd3b0a1c703a9fd144a6cfdedf9dcce_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
-
Filesize
36KB
-
Filesize
48KB