redline | 60041b714232153e8242343e1ba37d0ea013ce8daeac79f448b1cf96e6ada9a1

Analysis

max time kernel
142s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31-03-2024 07:35

Target

50bc2836e74c97d191533249f007a428_JaffaCakes118.exe
Size

364KB
MD5

50bc2836e74c97d191533249f007a428
SHA1

babd1767e0b52754572d1c2208db2d2bb1cd2891
SHA256

60041b714232153e8242343e1ba37d0ea013ce8daeac79f448b1cf96e6ada9a1
SHA512

99ff3652397f7ddf63423f00e27a24bda30b1fed6a20af94648926f89a59b5f906ad0775676133da48c28a3e177ba5e517bd6069f37c43b6fe3a74c8ec2c2257
SSDEEP

6144:4/MOJYyJ0FFuvC3EJH82nd34yD3XPaeG0mpeA1qX7tNfVXVHQLIiu8cfo0/pW:KMOayJ0uvo+c84x90C1wZGEX8cA0/M

Score

10^/10

Family

redline

Botnet

shop

45.9.20.107:46187

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2348-3-0x00000000049D0000-0x00000000049F4000-memory.dmp	family_redline
behavioral1/memory/2348-5-0x0000000007450000-0x0000000007490000-memory.dmp	family_redline
behavioral1/memory/2348-8-0x00000000049F0000-0x0000000004A12000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2348-3-0x00000000049D0000-0x00000000049F4000-memory.dmp	family_sectoprat
behavioral1/memory/2348-5-0x0000000007450000-0x0000000007490000-memory.dmp	family_sectoprat
behavioral1/memory/2348-8-0x00000000049F0000-0x0000000004A12000-memory.dmp	family_sectoprat

C:\Users\Admin\AppData\Local\Temp\50bc2836e74c97d191533249f007a428_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\50bc2836e74c97d191533249f007a428_JaffaCakes118.exe"
1⤵
PID:2348

memory/2348-1-0x00000000030B0000-0x00000000031B0000-memory.dmp

Filesize
1024KB

Download
memory/2348-2-0x0000000000250000-0x0000000000280000-memory.dmp

Filesize
192KB

Download
memory/2348-4-0x0000000000400000-0x0000000002F23000-memory.dmp

Filesize
43.1MB

Download
memory/2348-3-0x00000000049D0000-0x00000000049F4000-memory.dmp

Filesize
144KB

Download
memory/2348-5-0x0000000007450000-0x0000000007490000-memory.dmp

Filesize
256KB

Download
memory/2348-6-0x0000000074C10000-0x00000000752FE000-memory.dmp

Filesize
6.9MB

Download
memory/2348-7-0x0000000007450000-0x0000000007490000-memory.dmp

Filesize
256KB

Download
memory/2348-8-0x00000000049F0000-0x0000000004A12000-memory.dmp

Filesize
136KB

Download
memory/2348-9-0x0000000007450000-0x0000000007490000-memory.dmp

Filesize
256KB

Download
memory/2348-12-0x00000000030B0000-0x00000000031B0000-memory.dmp

Filesize
1024KB

Download
memory/2348-13-0x0000000007450000-0x0000000007490000-memory.dmp

Filesize
256KB

Download
memory/2348-14-0x0000000074C10000-0x00000000752FE000-memory.dmp

Filesize
6.9MB

Download
memory/2348-16-0x0000000007450000-0x0000000007490000-memory.dmp

Filesize
256KB

Download