redline | 008d589263f7e591b6fcd1561551a526cf5fba28430696c2a8e6b0a77640190b

General

Target

086a83749f45bb6bd1c932912a7caada_JaffaCakes118.exe
Size

486KB
MD5

086a83749f45bb6bd1c932912a7caada
SHA1

70c9ea62879084dbff0b60ddf15ff5e5f034cbed
SHA256

008d589263f7e591b6fcd1561551a526cf5fba28430696c2a8e6b0a77640190b
SHA512

babb508bc7e3dda46be61dc05d05d52e7f3351653c5c6b739c3e35a63363ff2e09103d3e478e1b027d9e3a5e2a980a6b0d18ec39f8c2d6f0db29fa61038d7427
SSDEEP

12288:ilrwEdNnGmst+vUHbaBE+5So5D7XQRr1F0/YTlS:GrGmi+W2WmSoR2BFMYTlS

Score

10^/10

redline sectoprat @lxxt3rx infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

@lxxt3rX

C2

185.213.209.36:36533

Attributes

auth_value
3e9eda97b6589ac15756de0ba010d48f

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

resource	yara_rule
behavioral1/memory/2096-14-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral1/memory/2096-26-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral1/memory/2096-25-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral1/memory/2096-28-0x0000000004A00000-0x0000000004A40000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 4 IoCs

resource	yara_rule
behavioral1/memory/2096-14-0x0000000000400000-0x0000000000422000-memory.dmp	family_sectoprat
behavioral1/memory/2096-26-0x0000000000400000-0x0000000000422000-memory.dmp	family_sectoprat
behavioral1/memory/2096-25-0x0000000000400000-0x0000000000422000-memory.dmp	family_sectoprat
behavioral1/memory/2096-28-0x0000000004A00000-0x0000000004A40000-memory.dmp	family_sectoprat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1656 set thread context of 2096	1656	086a83749f45bb6bd1c932912a7caada_JaffaCakes118.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2096	1656	086a83749f45bb6bd1c932912a7caada_JaffaCakes118.exe	28
PID 1656 wrote to memory of 2096	1656	086a83749f45bb6bd1c932912a7caada_JaffaCakes118.exe	28
PID 1656 wrote to memory of 2096	1656	086a83749f45bb6bd1c932912a7caada_JaffaCakes118.exe	28
PID 1656 wrote to memory of 2096	1656	086a83749f45bb6bd1c932912a7caada_JaffaCakes118.exe	28
PID 1656 wrote to memory of 2096	1656	086a83749f45bb6bd1c932912a7caada_JaffaCakes118.exe	28
PID 1656 wrote to memory of 2096	1656	086a83749f45bb6bd1c932912a7caada_JaffaCakes118.exe	28
PID 1656 wrote to memory of 2096	1656	086a83749f45bb6bd1c932912a7caada_JaffaCakes118.exe	28
PID 1656 wrote to memory of 2096	1656	086a83749f45bb6bd1c932912a7caada_JaffaCakes118.exe	28
PID 1656 wrote to memory of 2096	1656	086a83749f45bb6bd1c932912a7caada_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\086a83749f45bb6bd1c932912a7caada_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\086a83749f45bb6bd1c932912a7caada_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:2096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1656-8-0x00000000764E0000-0x0000000076527000-memory.dmp

Filesize
284KB

Download
memory/1656-10-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/1656-1-0x0000000000180000-0x000000000023D000-memory.dmp

Filesize
756KB

Download
memory/1656-4-0x0000000000180000-0x000000000023D000-memory.dmp

Filesize
756KB

Download
memory/1656-3-0x0000000000180000-0x000000000023D000-memory.dmp

Filesize
756KB

Download
memory/1656-5-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/1656-2-0x0000000000240000-0x0000000000284000-memory.dmp

Filesize
272KB

Download
memory/1656-6-0x0000000000180000-0x000000000023D000-memory.dmp

Filesize
756KB

Download
memory/1656-22-0x00000000764E0000-0x0000000076527000-memory.dmp

Filesize
284KB

Download
memory/1656-7-0x0000000000180000-0x000000000023D000-memory.dmp

Filesize
756KB

Download
memory/1656-9-0x0000000000180000-0x000000000023D000-memory.dmp

Filesize
756KB

Download
memory/1656-12-0x0000000000300000-0x0000000000400000-memory.dmp

Filesize
1024KB

Download
memory/1656-0-0x0000000000180000-0x000000000023D000-memory.dmp

Filesize
756KB

Download
memory/1656-24-0x0000000000240000-0x0000000000284000-memory.dmp

Filesize
272KB

Download
memory/1656-23-0x0000000074B50000-0x0000000074B53000-memory.dmp

Filesize
12KB

Download
memory/1656-21-0x0000000000180000-0x000000000023D000-memory.dmp

Filesize
756KB

Download
memory/2096-13-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2096-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2096-26-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2096-25-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2096-14-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2096-27-0x0000000074260000-0x000000007494E000-memory.dmp

Filesize
6.9MB

Download
memory/2096-28-0x0000000004A00000-0x0000000004A40000-memory.dmp

Filesize
256KB

Download
memory/2096-29-0x0000000074260000-0x000000007494E000-memory.dmp

Filesize
6.9MB

Download
memory/2096-30-0x0000000004A00000-0x0000000004A40000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing