redline | 7846f36f1ae5ad0c7347c9a429f189fb93e004211bd2b54a930eb6a0eda46134

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 15:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09b940b1ca2f7a46289f8f06ac95f873_JaffaCakes118.exe
Size

4.6MB
MD5

09b940b1ca2f7a46289f8f06ac95f873
SHA1

99659a326ac5502f2673623930daa27358bab499
SHA256

7846f36f1ae5ad0c7347c9a429f189fb93e004211bd2b54a930eb6a0eda46134
SHA512

d5eca922276a94440e7d496c69a7839b1530a4d25487b3ffcce6c6e04184ff483a7efa96250f89aedea565ebd1f8e3e6dc358d3410fb2863b80e9259460c786c
SSDEEP

98304:ZLvCtY2fD/NQGYkihGeAUdxL4PKdfWs8fJmj0NeRz40ahRSKyU4:MvfD1NBikvcxyKdl8f0j0eJahc

Score

10^/10

redline sectoprat @tvoiya_sydba infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

@tvoiya_sydba

185.209.22.181:34925

Attributes

auth_value
5a0918bd3e8ede8e02c8dd9d106a996d

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/3828-10-0x0000000000550000-0x0000000000572000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/3828-10-0x0000000000550000-0x0000000000572000-memory.dmp	family_sectoprat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3180 set thread context of 3828	3180	09b940b1ca2f7a46289f8f06ac95f873_JaffaCakes118.exe	96

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3636	3180	WerFault.exe	93

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3180	09b940b1ca2f7a46289f8f06ac95f873_JaffaCakes118.exe
3180	09b940b1ca2f7a46289f8f06ac95f873_JaffaCakes118.exe
3180	09b940b1ca2f7a46289f8f06ac95f873_JaffaCakes118.exe
3180	09b940b1ca2f7a46289f8f06ac95f873_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3180 wrote to memory of 3828	3180	09b940b1ca2f7a46289f8f06ac95f873_JaffaCakes118.exe	96
PID 3180 wrote to memory of 3828	3180	09b940b1ca2f7a46289f8f06ac95f873_JaffaCakes118.exe	96
PID 3180 wrote to memory of 3828	3180	09b940b1ca2f7a46289f8f06ac95f873_JaffaCakes118.exe	96
PID 3180 wrote to memory of 3828	3180	09b940b1ca2f7a46289f8f06ac95f873_JaffaCakes118.exe	96
PID 3180 wrote to memory of 3828	3180	09b940b1ca2f7a46289f8f06ac95f873_JaffaCakes118.exe	96

C:\Users\Admin\AppData\Local\Temp\09b940b1ca2f7a46289f8f06ac95f873_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\09b940b1ca2f7a46289f8f06ac95f873_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 272
  2⤵
  - Program crash
  PID:3636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3180 -ip 3180
1⤵
PID:3344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1400 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3180-0-0x0000000000400000-0x0000000000894000-memory.dmp

Filesize
4.6MB

Download
memory/3180-1-0x0000000000A40000-0x0000000000A41000-memory.dmp

Filesize
4KB

Download
memory/3180-2-0x0000000000A50000-0x0000000000A51000-memory.dmp

Filesize
4KB

Download
memory/3180-3-0x0000000000A80000-0x0000000000A81000-memory.dmp

Filesize
4KB

Download
memory/3180-4-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

Filesize
4KB

Download
memory/3180-6-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

Filesize
4KB

Download
memory/3180-5-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

Filesize
4KB

Download
memory/3180-7-0x0000000000400000-0x0000000000894000-memory.dmp

Filesize
4.6MB

Download
memory/3180-9-0x00000000000A0000-0x00000000001A0000-memory.dmp

Filesize
1024KB

Download
memory/3180-21-0x0000000000400000-0x0000000000894000-memory.dmp

Filesize
4.6MB

Download
memory/3828-15-0x0000000074170000-0x0000000074920000-memory.dmp

Filesize
7.7MB

Download
memory/3828-16-0x0000000005240000-0x0000000005858000-memory.dmp

Filesize
6.1MB

Download
memory/3828-17-0x0000000002730000-0x0000000002742000-memory.dmp

Filesize
72KB

Download
memory/3828-18-0x0000000004D30000-0x0000000004E3A000-memory.dmp

Filesize
1.0MB

Download
memory/3828-19-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

Filesize
64KB

Download
memory/3828-20-0x0000000002790000-0x00000000027CC000-memory.dmp

Filesize
240KB

Download
memory/3828-10-0x0000000000550000-0x0000000000572000-memory.dmp

Filesize
136KB

Download
memory/3828-22-0x0000000004C20000-0x0000000004C6C000-memory.dmp

Filesize
304KB

Download
memory/3828-23-0x0000000074170000-0x0000000074920000-memory.dmp

Filesize
7.7MB

Download
memory/3828-24-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

Filesize
64KB

Download