Analysis Overview
SHA256
4c64ae9b30e6896df0fe4643fd41b26dccb877e3d8a751c64192e2b55bd46903
Threat Level: Known bad
The file 6447700f9568bff991a3b8fdb07e72d3_JaffaCakes118 was found to be: Known bad.
Malicious Activity Summary
SectopRAT payload
RedLine
RedLine payload
SectopRAT
Unsigned PE
MITRE ATT&CK Matrix
Analysis: static1
Detonation Overview
Reported
2024-04-01 01:45
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-04-01 01:45
Reported
2024-04-01 01:48
Platform
win7-20240221-en
Max time kernel
142s
Max time network
143s
Command Line
Signatures
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
SectopRAT
SectopRAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\6447700f9568bff991a3b8fdb07e72d3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6447700f9568bff991a3b8fdb07e72d3_JaffaCakes118.exe"
Network
| Country | Destination | Domain | Proto |
| RU | 185.215.113.29:18087 | tcp | |
| RU | 185.215.113.29:18087 | tcp | |
| RU | 185.215.113.29:18087 | tcp | |
| RU | 185.215.113.29:18087 | tcp | |
| RU | 185.215.113.29:18087 | tcp | |
| RU | 185.215.113.29:18087 | tcp | |
| RU | 185.215.113.29:18087 | tcp |
Files
memory/2336-1-0x0000000000910000-0x0000000000A10000-memory.dmp
memory/2336-2-0x00000000002B0000-0x00000000002E0000-memory.dmp
memory/2336-3-0x0000000000400000-0x0000000000884000-memory.dmp
memory/2336-5-0x0000000074560000-0x0000000074C4E000-memory.dmp
memory/2336-6-0x0000000004DF0000-0x0000000004E30000-memory.dmp
memory/2336-4-0x00000000003E0000-0x0000000000406000-memory.dmp
memory/2336-7-0x0000000004DF0000-0x0000000004E30000-memory.dmp
memory/2336-8-0x00000000023A0000-0x00000000023C4000-memory.dmp
memory/2336-9-0x0000000000910000-0x0000000000A10000-memory.dmp
memory/2336-11-0x0000000074560000-0x0000000074C4E000-memory.dmp
memory/2336-12-0x0000000004DF0000-0x0000000004E30000-memory.dmp
memory/2336-14-0x0000000004DF0000-0x0000000004E30000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-04-01 01:45
Reported
2024-04-01 01:48
Platform
win10v2004-20240226-en
Max time kernel
150s
Max time network
150s
Command Line
Signatures
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
SectopRAT
SectopRAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\6447700f9568bff991a3b8fdb07e72d3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6447700f9568bff991a3b8fdb07e72d3_JaffaCakes118.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| RU | 185.215.113.29:18087 | tcp | |
| US | 8.8.8.8:53 | 64.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 79.121.231.20.in-addr.arpa | udp |
| RU | 185.215.113.29:18087 | tcp | |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.135.221.88.in-addr.arpa | udp |
| RU | 185.215.113.29:18087 | tcp | |
| RU | 185.215.113.29:18087 | tcp | |
| RU | 185.215.113.29:18087 | tcp | |
| US | 8.8.8.8:53 | 23.236.111.52.in-addr.arpa | udp |
| RU | 185.215.113.29:18087 | tcp | |
| RU | 185.215.113.29:18087 | tcp | |
| RU | 185.215.113.29:18087 | tcp | |
| US | 8.8.8.8:53 | udp |
Files
memory/1076-1-0x0000000000A70000-0x0000000000B70000-memory.dmp
memory/1076-2-0x00000000001C0000-0x00000000001F0000-memory.dmp
memory/1076-3-0x0000000000400000-0x0000000000884000-memory.dmp
memory/1076-4-0x0000000002A40000-0x0000000002A66000-memory.dmp
memory/1076-6-0x0000000005010000-0x0000000005020000-memory.dmp
memory/1076-5-0x0000000074B40000-0x00000000752F0000-memory.dmp
memory/1076-7-0x0000000005010000-0x0000000005020000-memory.dmp
memory/1076-8-0x0000000005020000-0x00000000055C4000-memory.dmp
memory/1076-9-0x0000000004F20000-0x0000000004F44000-memory.dmp
memory/1076-10-0x00000000055D0000-0x0000000005BE8000-memory.dmp
memory/1076-11-0x0000000004FE0000-0x0000000004FF2000-memory.dmp
memory/1076-12-0x0000000005BF0000-0x0000000005CFA000-memory.dmp
memory/1076-13-0x0000000005010000-0x0000000005020000-memory.dmp
memory/1076-14-0x0000000005D00000-0x0000000005D3C000-memory.dmp
memory/1076-15-0x0000000005D70000-0x0000000005DBC000-memory.dmp
memory/1076-16-0x0000000000A70000-0x0000000000B70000-memory.dmp
memory/1076-17-0x0000000000400000-0x0000000000884000-memory.dmp
memory/1076-18-0x00000000001C0000-0x00000000001F0000-memory.dmp
memory/1076-19-0x0000000074B40000-0x00000000752F0000-memory.dmp
memory/1076-20-0x0000000005010000-0x0000000005020000-memory.dmp
memory/1076-22-0x0000000005010000-0x0000000005020000-memory.dmp
memory/1076-23-0x0000000005010000-0x0000000005020000-memory.dmp
memory/1076-24-0x0000000005010000-0x0000000005020000-memory.dmp