redline | 579214390f165480aa3ff4991f1a6eb8b6d946dc02e9ecc075a7b816e9ffdfba

Analysis

max time kernel
141s
max time network
141s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-03-2024 20:39

Target

0f7db123d145142719c707374a5848a4_JaffaCakes118.exe
Size

808KB
MD5

0f7db123d145142719c707374a5848a4
SHA1

b2a03dbf263d4a50caf841fbb00ffa8f0f071ee1
SHA256

579214390f165480aa3ff4991f1a6eb8b6d946dc02e9ecc075a7b816e9ffdfba
SHA512

0e5e7dd009452dbb7e32ee34f65e4a2336f20ca19f596c3ba82131d130a0ce9bf6b7f15e4258de1f1eb5b932f9b499e95bf15c05dd096d0160427d3161f744c1
SSDEEP

12288:F1FwPtoB/POTISLoKiGmRh0Mpjm8LWUNGkIPP5QlzNl26TieMdWLnYn2gM2M/tHh:vFwPtoB/PA7niRpOhONTieTnYn2g6tHh

Score

10^/10

Family

redline

Botnet

176.57.71.68:37814

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1116-0-0x00000000003A0000-0x00000000003D1000-memory.dmp	family_redline
behavioral1/memory/1116-7-0x00000000003A0000-0x00000000003D1000-memory.dmp	family_redline
behavioral1/memory/1116-8-0x0000000000770000-0x0000000000792000-memory.dmp	family_redline
behavioral1/memory/1116-10-0x0000000000770000-0x0000000000792000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1116-0-0x00000000003A0000-0x00000000003D1000-memory.dmp	family_sectoprat
behavioral1/memory/1116-7-0x00000000003A0000-0x00000000003D1000-memory.dmp	family_sectoprat
behavioral1/memory/1116-8-0x0000000000770000-0x0000000000792000-memory.dmp	family_sectoprat
behavioral1/memory/1116-10-0x0000000000770000-0x0000000000792000-memory.dmp	family_sectoprat

C:\Users\Admin\AppData\Local\Temp\0f7db123d145142719c707374a5848a4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0f7db123d145142719c707374a5848a4_JaffaCakes118.exe"
1⤵
PID:1116

memory/1116-0-0x00000000003A0000-0x00000000003D1000-memory.dmp

Filesize
196KB

Download
memory/1116-7-0x00000000003A0000-0x00000000003D1000-memory.dmp

Filesize
196KB

Download
memory/1116-8-0x0000000000770000-0x0000000000792000-memory.dmp

Filesize
136KB

Download
memory/1116-9-0x0000000074A30000-0x000000007511E000-memory.dmp

Filesize
6.9MB

Download
memory/1116-11-0x0000000002100000-0x0000000002140000-memory.dmp

Filesize
256KB

Download
memory/1116-10-0x0000000000770000-0x0000000000792000-memory.dmp

Filesize
136KB

Download
memory/1116-12-0x0000000002100000-0x0000000002140000-memory.dmp

Filesize
256KB

Download
memory/1116-13-0x0000000002100000-0x0000000002140000-memory.dmp

Filesize
256KB

Download
memory/1116-14-0x0000000000500000-0x00000000005D0000-memory.dmp

Filesize
832KB

Download
memory/1116-15-0x0000000074A30000-0x000000007511E000-memory.dmp

Filesize
6.9MB

Download
memory/1116-17-0x0000000002100000-0x0000000002140000-memory.dmp

Filesize
256KB

Download