Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
13-06-2024 13:46
General
-
Target
a5dcaee3c7e128dc0a4695b534924151_JaffaCakes118.exe
-
Size
464KB
-
MD5
a5dcaee3c7e128dc0a4695b534924151
-
SHA1
b2a12f1958dd3dc14f7eace777ce06fad33b177d
-
SHA256
5be7a56599e1da2758bd361a5126bcccd7d66e8c8f2532879475f47e46022bf5
-
SHA512
0187591858621a62f92067d7e616632836914776b0b7ced0b945d8844d4c586dbf0d45fea826a94749054ee13bf854457cd4bb754777eae14d3da906578d57b8
-
SSDEEP
6144:OsyICKQ+f35V6hJHWyoEMvQ8X3T4iWGidXXdz4b71QKPIXVKx2g1iRG+6KaPxdFI:AICKQDHWylMDtOXXdz4b+1KesxH99AV9
Malware Config
Extracted
emotet
Epoch2
104.32.141.43:80
104.156.59.7:8080
120.138.30.150:8080
139.59.67.118:443
61.92.17.12:80
103.86.49.11:8080
174.45.13.118:80
75.139.38.211:80
104.131.11.150:443
121.124.124.40:7080
200.114.213.233:8080
185.94.252.104:443
181.169.34.190:80
187.161.206.24:80
93.147.212.206:80
176.111.60.55:8080
83.169.36.251:8080
174.102.48.180:443
24.179.13.119:80
120.150.60.189:80
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet payload 3 IoCs
Detects Emotet payload in memory.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5dcaee3c7e128dc0a4695b534924151_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5dcaee3c7e128dc0a4695b534924151_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2980-7-0x00000000002F0000-0x00000000002FF000-memory.dmpFilesize
60KB
-
memory/2980-4-0x0000000000320000-0x0000000000330000-memory.dmpFilesize
64KB
-
memory/2980-0-0x0000000000300000-0x0000000000312000-memory.dmpFilesize
72KB