Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02-04-2024 10:28
Static task
static1
Behavioral task
behavioral1
Sample
8a07091354324b193789a6b265e5726a_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
8a07091354324b193789a6b265e5726a_JaffaCakes118.exe
-
Size
385KB
-
MD5
8a07091354324b193789a6b265e5726a
-
SHA1
479a91422406e05844d46e15cd021bc5eddb7af0
-
SHA256
951eee62f9678f774f46b2b452ecf66cea62a8bee377fedc9c787ec50e339170
-
SHA512
d36a72dac805195cc4f638ee156de283b18335a8ab3ff27241fef56d1bab7b08a8d55996708e82352467e8105d7671f7ddda287adc4d9fa341ce40ab4f617330
-
SSDEEP
6144:ZKH2svwtXlDloCce3AbGGOO3hBqjovaW9nD3ceU6HPbGMjgjn0:ZKQtXVmC1ShIjoSKnDA6HDFEn0
Malware Config
Extracted
redline
build
77.232.40.127:8204
-
auth_value
275ce2c87153d4e8e3cc276c686a93de
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/5056-4-0x0000000003460000-0x0000000003484000-memory.dmp family_redline behavioral2/memory/5056-9-0x0000000003760000-0x0000000003782000-memory.dmp family_redline -
SectopRAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/5056-4-0x0000000003460000-0x0000000003484000-memory.dmp family_sectoprat behavioral2/memory/5056-6-0x0000000005E90000-0x0000000005EA0000-memory.dmp family_sectoprat behavioral2/memory/5056-9-0x0000000003760000-0x0000000003782000-memory.dmp family_sectoprat
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/5056-1-0x0000000001840000-0x0000000001940000-memory.dmpFilesize
1024KB
-
memory/5056-2-0x0000000001760000-0x0000000001790000-memory.dmpFilesize
192KB
-
memory/5056-3-0x0000000000400000-0x00000000016D3000-memory.dmpFilesize
18.8MB
-
memory/5056-4-0x0000000003460000-0x0000000003484000-memory.dmpFilesize
144KB
-
memory/5056-5-0x0000000074650000-0x0000000074E00000-memory.dmpFilesize
7.7MB
-
memory/5056-6-0x0000000005E90000-0x0000000005EA0000-memory.dmpFilesize
64KB
-
memory/5056-8-0x0000000005EA0000-0x0000000006444000-memory.dmpFilesize
5.6MB
-
memory/5056-7-0x0000000005E90000-0x0000000005EA0000-memory.dmpFilesize
64KB
-
memory/5056-9-0x0000000003760000-0x0000000003782000-memory.dmpFilesize
136KB
-
memory/5056-10-0x0000000006550000-0x00000000065E2000-memory.dmpFilesize
584KB
-
memory/5056-11-0x00000000065F0000-0x0000000006C08000-memory.dmpFilesize
6.1MB
-
memory/5056-12-0x0000000006C10000-0x0000000006C22000-memory.dmpFilesize
72KB
-
memory/5056-13-0x0000000006C40000-0x0000000006D4A000-memory.dmpFilesize
1.0MB
-
memory/5056-15-0x0000000006E70000-0x0000000006EAC000-memory.dmpFilesize
240KB
-
memory/5056-14-0x0000000005E90000-0x0000000005EA0000-memory.dmpFilesize
64KB
-
memory/5056-16-0x0000000006FD0000-0x000000000701C000-memory.dmpFilesize
304KB
-
memory/5056-17-0x0000000000400000-0x00000000016D3000-memory.dmpFilesize
18.8MB
-
memory/5056-18-0x0000000001760000-0x0000000001790000-memory.dmpFilesize
192KB
-
memory/5056-19-0x0000000001840000-0x0000000001940000-memory.dmpFilesize
1024KB
-
memory/5056-20-0x0000000074650000-0x0000000074E00000-memory.dmpFilesize
7.7MB
-
memory/5056-22-0x0000000005E90000-0x0000000005EA0000-memory.dmpFilesize
64KB
-
memory/5056-23-0x0000000005E90000-0x0000000005EA0000-memory.dmpFilesize
64KB
-
memory/5056-24-0x0000000005E90000-0x0000000005EA0000-memory.dmpFilesize
64KB