redline | 38f872957df8d51c6811126c67a133531335babd02f878052263e6934e8d4161

Analysis

max time kernel
146s
max time network
148s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31-03-2024 02:37

Target

4ae1678a6a7642981a55f2701408bebf_JaffaCakes118.exe
Size

360KB
MD5

4ae1678a6a7642981a55f2701408bebf
SHA1

c735c1f5ced6d2f85d71c245cffea2beb2d999a1
SHA256

38f872957df8d51c6811126c67a133531335babd02f878052263e6934e8d4161
SHA512

392289b891c9e7193cda1d15a756af6fb2e61cdd97aef7b26ea3bdde4278a1838110a04dc8e5126c340b10522454da4a345f56feb1d6e7072c989401d9ffc319
SSDEEP

6144:xFDPgKGc9yWGwbUYU+jL8Rkvc1imUVx98aCYcW5SL:rLgKGc9Lbz//8iH8ocW5SL

Score

10^/10

Family

redline

Botnet

usamoney

45.142.215.47:27643

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3028-4-0x00000000003E0000-0x0000000000404000-memory.dmp	family_redline
behavioral1/memory/3028-6-0x0000000004840000-0x0000000004880000-memory.dmp	family_redline
behavioral1/memory/3028-8-0x0000000002070000-0x0000000002092000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3028-4-0x00000000003E0000-0x0000000000404000-memory.dmp	family_sectoprat
behavioral1/memory/3028-6-0x0000000004840000-0x0000000004880000-memory.dmp	family_sectoprat
behavioral1/memory/3028-8-0x0000000002070000-0x0000000002092000-memory.dmp	family_sectoprat

C:\Users\Admin\AppData\Local\Temp\4ae1678a6a7642981a55f2701408bebf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4ae1678a6a7642981a55f2701408bebf_JaffaCakes118.exe"
1⤵
PID:3028

memory/3028-1-0x0000000000650000-0x0000000000750000-memory.dmp

Filesize
1024KB

Download
memory/3028-2-0x0000000000230000-0x0000000000260000-memory.dmp

Filesize
192KB

Download
memory/3028-3-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3028-5-0x00000000745B0000-0x0000000074C9E000-memory.dmp

Filesize
6.9MB

Download
memory/3028-4-0x00000000003E0000-0x0000000000404000-memory.dmp

Filesize
144KB

Download
memory/3028-7-0x0000000004840000-0x0000000004880000-memory.dmp

Filesize
256KB

Download
memory/3028-6-0x0000000004840000-0x0000000004880000-memory.dmp

Filesize
256KB

Download
memory/3028-8-0x0000000002070000-0x0000000002092000-memory.dmp

Filesize
136KB

Download
memory/3028-10-0x0000000000650000-0x0000000000750000-memory.dmp

Filesize
1024KB

Download
memory/3028-11-0x00000000745B0000-0x0000000074C9E000-memory.dmp

Filesize
6.9MB

Download
memory/3028-12-0x0000000004840000-0x0000000004880000-memory.dmp

Filesize
256KB

Download
memory/3028-13-0x0000000004840000-0x0000000004880000-memory.dmp

Filesize
256KB

Download
memory/3028-15-0x0000000004840000-0x0000000004880000-memory.dmp

Filesize
256KB

Download