Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30-03-2024 19:12
Static task
static1
Behavioral task
behavioral1
Sample
42542f5e7306f86420913fc60b3091bd_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
42542f5e7306f86420913fc60b3091bd_JaffaCakes118.exe
-
Size
376KB
-
MD5
42542f5e7306f86420913fc60b3091bd
-
SHA1
4ee2a86dee38ce87efeb6255720afc934402b23f
-
SHA256
5b051a47a380e66a8218afcd6bd7e78d140f7f3983dee73e9816e7997a98cc9f
-
SHA512
bfa98ceacee4d34dfd685ed2b5478bb36ea4669788667413a3089864456128ec4bc0e8faeb208c71aa809d21a5afff36872846ac2d6aca89c53ea91bd077966a
-
SSDEEP
6144:EJDV1/0CPVm6CNNCEEheoxMHGxO202F4cZLLGlm2MC+0VcR4mPm:QD//TIN7N8tKcZLLGo220VcR4
Malware Config
Extracted
redline
777
oucesesstor.xyz:81
edaycamanel.xyz:81
-
auth_value
164c9110509d4287fde8e8f70e9d3b36
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2240-3-0x00000000003D0000-0x00000000003F4000-memory.dmp family_redline behavioral1/memory/2240-4-0x0000000004AE0000-0x0000000004B02000-memory.dmp family_redline -
SectopRAT payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2240-3-0x00000000003D0000-0x00000000003F4000-memory.dmp family_sectoprat behavioral1/memory/2240-4-0x0000000004AE0000-0x0000000004B02000-memory.dmp family_sectoprat
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2240-1-0x0000000003200000-0x0000000003300000-memory.dmpFilesize
1024KB
-
memory/2240-2-0x0000000000240000-0x0000000000270000-memory.dmpFilesize
192KB
-
memory/2240-3-0x00000000003D0000-0x00000000003F4000-memory.dmpFilesize
144KB
-
memory/2240-4-0x0000000004AE0000-0x0000000004B02000-memory.dmpFilesize
136KB
-
memory/2240-5-0x0000000000400000-0x0000000002DB5000-memory.dmpFilesize
41.7MB
-
memory/2240-6-0x0000000007310000-0x0000000007350000-memory.dmpFilesize
256KB
-
memory/2240-7-0x0000000007310000-0x0000000007350000-memory.dmpFilesize
256KB
-
memory/2240-8-0x0000000074D90000-0x000000007547E000-memory.dmpFilesize
6.9MB
-
memory/2240-9-0x0000000000400000-0x0000000002DB5000-memory.dmpFilesize
41.7MB
-
memory/2240-10-0x0000000003200000-0x0000000003300000-memory.dmpFilesize
1024KB
-
memory/2240-11-0x0000000000240000-0x0000000000270000-memory.dmpFilesize
192KB
-
memory/2240-13-0x0000000007310000-0x0000000007350000-memory.dmpFilesize
256KB
-
memory/2240-14-0x0000000074D90000-0x000000007547E000-memory.dmpFilesize
6.9MB