Overview

overview

10

Static

static

3

a748b57cfc...18.exe

windows7-x64

10

a748b57cfc...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20240319-en
  • resource tags

    arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
  • submitted
    03-04-2024 21:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a748b57cfce986e9807d621dfad23b51_JaffaCakes118.exe

  • Size

    406KB

  • MD5

    a748b57cfce986e9807d621dfad23b51

  • SHA1

    fb8fe85db6ec1c161e4a2100df0267a743b07031

  • SHA256

    1faa3ca4bb018ed42a8c59b1d48886eadc2ac59a64d762ac600bc2af442b8389

  • SHA512

    46914209095c7c56609bf457aa543510903045c35dae74ffaecf6e7ccc2006d3dafe0b293ee316db0447ab94b38dbe908b005c4e1d38f5f5bd54fa61179fef69

  • SSDEEP

    6144:kgmVQorT9wi5eG/NwdgQqhP8dgaGu3qcJbQPyumeL5D:kPfT7f/NwdgQ2UdgaJ3jyPvme5

Score
10/10
redlinesectoprat777infostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

777

C2

oucesesstor.xyz:81

edaycamanel.xyz:81
Attributes
  • auth_value

    164c9110509d4287fde8e8f70e9d3b36

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 2 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat
  • SectopRAT payload 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a748b57cfce986e9807d621dfad23b51_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a748b57cfce986e9807d621dfad23b51_JaffaCakes118.exe"
    1⤵
      PID:1788

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1788-1-0x0000000000290000-0x0000000000390000-memory.dmp
      Filesize

      1024KB

      Download
    • memory/1788-2-0x0000000000260000-0x0000000000290000-memory.dmp
      Filesize

      192KB

      Download
    • memory/1788-3-0x0000000000400000-0x0000000000797000-memory.dmp
      Filesize

      3.6MB

      Download
    • memory/1788-5-0x0000000074840000-0x0000000074F2E000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/1788-4-0x0000000001FF0000-0x0000000002014000-memory.dmp
      Filesize

      144KB

      Download
    • memory/1788-6-0x0000000004C60000-0x0000000004CA0000-memory.dmp
      Filesize

      256KB

      Download
    • memory/1788-7-0x0000000004C60000-0x0000000004CA0000-memory.dmp
      Filesize

      256KB

      Download
    • memory/1788-8-0x0000000002060000-0x0000000002082000-memory.dmp
      Filesize

      136KB

      Download
    • memory/1788-9-0x0000000004C60000-0x0000000004CA0000-memory.dmp
      Filesize

      256KB

      Download
    • memory/1788-10-0x0000000000400000-0x0000000000797000-memory.dmp
      Filesize

      3.6MB

      Download
    • memory/1788-11-0x0000000000260000-0x0000000000290000-memory.dmp
      Filesize

      192KB

      Download
    • memory/1788-12-0x0000000000290000-0x0000000000390000-memory.dmp
      Filesize

      1024KB

      Download
    • memory/1788-13-0x0000000074840000-0x0000000074F2E000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/1788-14-0x0000000004C60000-0x0000000004CA0000-memory.dmp
      Filesize

      256KB

      Download
    • memory/1788-16-0x0000000004C60000-0x0000000004CA0000-memory.dmp
      Filesize

      256KB

      Download