redline | 60041b714232153e8242343e1ba37d0ea013ce8daeac79f448b1cf96e6ada9a1

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
31-03-2024 07:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

50bc2836e74c97d191533249f007a428_JaffaCakes118.exe
Size

364KB
MD5

50bc2836e74c97d191533249f007a428
SHA1

babd1767e0b52754572d1c2208db2d2bb1cd2891
SHA256

60041b714232153e8242343e1ba37d0ea013ce8daeac79f448b1cf96e6ada9a1
SHA512

99ff3652397f7ddf63423f00e27a24bda30b1fed6a20af94648926f89a59b5f906ad0775676133da48c28a3e177ba5e517bd6069f37c43b6fe3a74c8ec2c2257
SSDEEP

6144:4/MOJYyJ0FFuvC3EJH82nd34yD3XPaeG0mpeA1qX7tNfVXVHQLIiu8cfo0/pW:KMOayJ0uvo+c84x90C1wZGEX8cA0/M

Score

10^/10

redline sectoprat shop infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

shop

45.9.20.107:46187

Attributes

auth_value
60c75f1e2d31f6bac6dd7edad67d8615

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2192-3-0x0000000004E20000-0x0000000004E44000-memory.dmp	family_redline
behavioral2/memory/2192-6-0x0000000005170000-0x0000000005192000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2192-3-0x0000000004E20000-0x0000000004E44000-memory.dmp	family_sectoprat
behavioral2/memory/2192-7-0x00000000076C0000-0x00000000076D0000-memory.dmp	family_sectoprat
behavioral2/memory/2192-6-0x0000000005170000-0x0000000005192000-memory.dmp	family_sectoprat

C:\Users\Admin\AppData\Local\Temp\50bc2836e74c97d191533249f007a428_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\50bc2836e74c97d191533249f007a428_JaffaCakes118.exe"
1⤵
PID:2192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4132 --field-trial-handle=2260,i,4762972005863767630,9297428255150568035,262144 --variations-seed-version /prefetch:8
1⤵
PID:3212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2192-1-0x00000000031F0000-0x00000000032F0000-memory.dmp

Filesize
1024KB

Download
memory/2192-2-0x0000000004C90000-0x0000000004CC0000-memory.dmp

Filesize
192KB

Download
memory/2192-3-0x0000000004E20000-0x0000000004E44000-memory.dmp

Filesize
144KB

Download
memory/2192-4-0x0000000000400000-0x0000000002F23000-memory.dmp

Filesize
43.1MB

Download
memory/2192-5-0x00000000076D0000-0x0000000007C74000-memory.dmp

Filesize
5.6MB

Download
memory/2192-7-0x00000000076C0000-0x00000000076D0000-memory.dmp

Filesize
64KB

Download
memory/2192-6-0x0000000005170000-0x0000000005192000-memory.dmp

Filesize
136KB

Download
memory/2192-8-0x00000000076C0000-0x00000000076D0000-memory.dmp

Filesize
64KB

Download
memory/2192-9-0x00000000076C0000-0x00000000076D0000-memory.dmp

Filesize
64KB

Download
memory/2192-10-0x0000000007C80000-0x0000000008298000-memory.dmp

Filesize
6.1MB

Download
memory/2192-11-0x0000000007680000-0x0000000007692000-memory.dmp

Filesize
72KB

Download
memory/2192-12-0x00000000082A0000-0x00000000083AA000-memory.dmp

Filesize
1.0MB

Download
memory/2192-13-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/2192-14-0x00000000083B0000-0x00000000083EC000-memory.dmp

Filesize
240KB

Download
memory/2192-15-0x00000000076C0000-0x00000000076D0000-memory.dmp

Filesize
64KB

Download
memory/2192-16-0x0000000008410000-0x000000000845C000-memory.dmp

Filesize
304KB

Download
memory/2192-19-0x00000000031F0000-0x00000000032F0000-memory.dmp

Filesize
1024KB

Download
memory/2192-20-0x0000000004C90000-0x0000000004CC0000-memory.dmp

Filesize
192KB

Download
memory/2192-21-0x00000000076C0000-0x00000000076D0000-memory.dmp

Filesize
64KB

Download
memory/2192-22-0x00000000076C0000-0x00000000076D0000-memory.dmp

Filesize
64KB

Download
memory/2192-23-0x00000000076C0000-0x00000000076D0000-memory.dmp

Filesize
64KB

Download
memory/2192-24-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/2192-26-0x00000000076C0000-0x00000000076D0000-memory.dmp

Filesize
64KB

Download