Analysis
-
max time kernel
140s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-06-2024 08:31
Static task
static1
Behavioral task
behavioral1
Sample
07773acf292f8fabf91bfe0373f87614_JaffaCakes118.dll
Resource
win7-20240508-en
General
-
Target
07773acf292f8fabf91bfe0373f87614_JaffaCakes118.dll
-
Size
340KB
-
MD5
07773acf292f8fabf91bfe0373f87614
-
SHA1
7714cce0230c3ac1ecea014cfe1c8ec23b347806
-
SHA256
5ea73927cb8a0de222dad898d078fba8cd9e3267907408affa01e90a4430119e
-
SHA512
f7a368a373ff6bdf4ceaa12808f6e757b0504688b035a16795c74311a8c77c2d331de764da9add88185f635f8a411f60d3af678ead4ff075986dc23a1ed51e82
-
SSDEEP
3072:kvA1p08RqEQAIVEd2gG/vNlo0JFx/pANyCm0PQEKR/J+XCtT:k206xWgGxLxWN40PDKR/J+XaT
Malware Config
Extracted
emotet
Epoch2
108.53.88.101:443
195.159.28.230:8080
162.241.204.233:8080
74.40.205.197:443
93.146.48.84:80
78.189.148.42:80
139.99.158.11:443
61.19.246.238:443
37.139.21.175:8080
118.83.154.64:443
85.105.205.77:8080
176.111.60.55:8080
50.116.111.59:8080
75.109.111.18:80
181.165.68.127:80
78.182.254.231:80
110.145.101.66:443
24.179.13.119:80
121.124.124.40:7080
115.21.224.117:80
188.165.214.98:8080
24.164.79.147:8080
190.103.228.24:80
64.207.182.168:8080
188.219.31.12:80
172.125.40.123:80
120.150.60.189:80
186.74.215.34:80
50.245.107.73:443
181.171.209.241:443
85.105.111.166:80
185.94.252.104:443
185.201.9.197:8080
220.245.198.194:80
173.70.61.180:80
172.104.97.173:8080
139.162.60.124:8080
136.244.110.184:8080
79.137.83.50:443
109.74.5.95:8080
24.231.88.85:80
62.171.142.179:8080
5.39.91.110:7080
78.24.219.147:8080
46.105.131.79:8080
197.211.245.21:80
75.177.207.146:80
74.208.45.104:8080
94.23.237.171:443
217.20.166.178:7080
203.153.216.189:7080
144.217.7.207:7080
79.130.130.240:8080
78.188.225.105:80
87.106.139.101:8080
110.145.11.73:80
109.116.245.80:80
66.57.108.14:443
74.58.215.226:80
70.183.211.3:80
49.205.182.134:80
180.222.161.85:80
174.118.202.24:443
119.59.116.21:8080
134.209.144.106:443
161.0.153.60:80
168.235.67.138:7080
110.142.236.207:80
167.114.153.111:8080
75.113.193.72:80
190.240.194.77:443
200.116.145.225:443
157.245.99.39:8080
194.4.58.192:7080
187.161.206.24:80
98.109.133.80:80
202.134.4.211:8080
71.72.196.159:80
104.131.11.150:443
172.86.188.251:8080
70.92.118.112:80
24.178.90.49:80
194.190.67.75:80
89.216.122.92:80
59.21.235.119:80
69.49.88.46:80
139.59.60.244:8080
74.128.121.17:80
190.251.200.206:80
202.134.4.216:8080
24.69.65.8:8080
62.75.141.82:80
12.175.220.98:80
115.94.207.99:443
50.91.114.38:80
138.68.87.218:443
41.185.28.84:8080
2.58.16.89:8080
95.9.5.93:80
120.150.218.241:443
123.176.25.234:80
37.187.72.193:8080
89.106.251.163:80
95.213.236.64:8080
172.105.13.66:443
51.89.36.180:443
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 11 4392 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exepid process 4392 rundll32.exe 4392 rundll32.exe 4392 rundll32.exe 4392 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3556 wrote to memory of 4392 3556 rundll32.exe rundll32.exe PID 3556 wrote to memory of 4392 3556 rundll32.exe rundll32.exe PID 3556 wrote to memory of 4392 3556 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\07773acf292f8fabf91bfe0373f87614_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\07773acf292f8fabf91bfe0373f87614_JaffaCakes118.dll,#12⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses