Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24-06-2024 08:31
Static task
static1
Behavioral task
behavioral1
Sample
07773acf292f8fabf91bfe0373f87614_JaffaCakes118.dll
Resource
win7-20240508-en
General
-
Target
07773acf292f8fabf91bfe0373f87614_JaffaCakes118.dll
-
Size
340KB
-
MD5
07773acf292f8fabf91bfe0373f87614
-
SHA1
7714cce0230c3ac1ecea014cfe1c8ec23b347806
-
SHA256
5ea73927cb8a0de222dad898d078fba8cd9e3267907408affa01e90a4430119e
-
SHA512
f7a368a373ff6bdf4ceaa12808f6e757b0504688b035a16795c74311a8c77c2d331de764da9add88185f635f8a411f60d3af678ead4ff075986dc23a1ed51e82
-
SSDEEP
3072:kvA1p08RqEQAIVEd2gG/vNlo0JFx/pANyCm0PQEKR/J+XCtT:k206xWgGxLxWN40PDKR/J+XaT
Malware Config
Extracted
emotet
Epoch2
108.53.88.101:443
195.159.28.230:8080
162.241.204.233:8080
74.40.205.197:443
93.146.48.84:80
78.189.148.42:80
139.99.158.11:443
61.19.246.238:443
37.139.21.175:8080
118.83.154.64:443
85.105.205.77:8080
176.111.60.55:8080
50.116.111.59:8080
75.109.111.18:80
181.165.68.127:80
78.182.254.231:80
110.145.101.66:443
24.179.13.119:80
121.124.124.40:7080
115.21.224.117:80
188.165.214.98:8080
24.164.79.147:8080
190.103.228.24:80
64.207.182.168:8080
188.219.31.12:80
172.125.40.123:80
120.150.60.189:80
186.74.215.34:80
50.245.107.73:443
181.171.209.241:443
85.105.111.166:80
185.94.252.104:443
185.201.9.197:8080
220.245.198.194:80
173.70.61.180:80
172.104.97.173:8080
139.162.60.124:8080
136.244.110.184:8080
79.137.83.50:443
109.74.5.95:8080
24.231.88.85:80
62.171.142.179:8080
5.39.91.110:7080
78.24.219.147:8080
46.105.131.79:8080
197.211.245.21:80
75.177.207.146:80
74.208.45.104:8080
94.23.237.171:443
217.20.166.178:7080
203.153.216.189:7080
144.217.7.207:7080
79.130.130.240:8080
78.188.225.105:80
87.106.139.101:8080
110.145.11.73:80
109.116.245.80:80
66.57.108.14:443
74.58.215.226:80
70.183.211.3:80
49.205.182.134:80
180.222.161.85:80
174.118.202.24:443
119.59.116.21:8080
134.209.144.106:443
161.0.153.60:80
168.235.67.138:7080
110.142.236.207:80
167.114.153.111:8080
75.113.193.72:80
190.240.194.77:443
200.116.145.225:443
157.245.99.39:8080
194.4.58.192:7080
187.161.206.24:80
98.109.133.80:80
202.134.4.211:8080
71.72.196.159:80
104.131.11.150:443
172.86.188.251:8080
70.92.118.112:80
24.178.90.49:80
194.190.67.75:80
89.216.122.92:80
59.21.235.119:80
69.49.88.46:80
139.59.60.244:8080
74.128.121.17:80
190.251.200.206:80
202.134.4.216:8080
24.69.65.8:8080
62.75.141.82:80
12.175.220.98:80
115.94.207.99:443
50.91.114.38:80
138.68.87.218:443
41.185.28.84:8080
2.58.16.89:8080
95.9.5.93:80
120.150.218.241:443
123.176.25.234:80
37.187.72.193:8080
89.106.251.163:80
95.213.236.64:8080
172.105.13.66:443
51.89.36.180:443
Signatures
-
Blocklisted process makes network request 7 IoCs
Processes:
rundll32.exeflow pid process 3 1728 rundll32.exe 5 1728 rundll32.exe 8 1728 rundll32.exe 9 1728 rundll32.exe 10 1728 rundll32.exe 11 1728 rundll32.exe 13 1728 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
rundll32.exepid process 1728 rundll32.exe 1728 rundll32.exe 1728 rundll32.exe 1728 rundll32.exe 1728 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1868 wrote to memory of 1728 1868 rundll32.exe rundll32.exe PID 1868 wrote to memory of 1728 1868 rundll32.exe rundll32.exe PID 1868 wrote to memory of 1728 1868 rundll32.exe rundll32.exe PID 1868 wrote to memory of 1728 1868 rundll32.exe rundll32.exe PID 1868 wrote to memory of 1728 1868 rundll32.exe rundll32.exe PID 1868 wrote to memory of 1728 1868 rundll32.exe rundll32.exe PID 1868 wrote to memory of 1728 1868 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\07773acf292f8fabf91bfe0373f87614_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\07773acf292f8fabf91bfe0373f87614_JaffaCakes118.dll,#12⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1728-0-0x0000000010000000-0x0000000010023000-memory.dmpFilesize
140KB
-
memory/1728-1-0x0000000000170000-0x0000000000190000-memory.dmpFilesize
128KB
-
memory/1728-2-0x0000000010000000-0x0000000010023000-memory.dmpFilesize
140KB
-
memory/1728-3-0x0000000010000000-0x0000000010023000-memory.dmpFilesize
140KB