Analysis

  • max time kernel
    119s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240319-en
  • resource tags

    arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
  • submitted
    05/04/2024, 01:19

General

  • Target

    c6e49eb4a9fa7805b61b18acfbd5e6f5_JaffaCakes118.exe

  • Size

    422KB

  • MD5

    c6e49eb4a9fa7805b61b18acfbd5e6f5

  • SHA1

    4974abe12b21c0938aa1088ac30dba4b378338cc

  • SHA256

    fac8be8d340fd63f907927b82cf0e193782cbf17d6424c899c24dd4ff8a60ae4

  • SHA512

    44d85d7755bd30d871bc27bc88514fc1e85cd7511899f8e5daf9bc252422e2b5e43aafa4bdb981721a1ebbaf0e3ccacb761bc6fd0aae5a72929dae2327409c62

  • SSDEEP

    12288:Uz86gobvzrMo/uvr0403NV95QUIH8ocW5SK:UBgobLIAiv03NniUIH8781

Score
10/10

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c6e49eb4a9fa7805b61b18acfbd5e6f5_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\c6e49eb4a9fa7805b61b18acfbd5e6f5_JaffaCakes118.exe"
    1⤵
      PID:2228

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/2228-1-0x0000000000670000-0x0000000000770000-memory.dmp

            Filesize

            1024KB

          • memory/2228-3-0x0000000000400000-0x00000000004DB000-memory.dmp

            Filesize

            876KB

          • memory/2228-2-0x0000000000230000-0x0000000000270000-memory.dmp

            Filesize

            256KB

          • memory/2228-5-0x00000000023C0000-0x0000000002406000-memory.dmp

            Filesize

            280KB

          • memory/2228-4-0x0000000074610000-0x0000000074CFE000-memory.dmp

            Filesize

            6.9MB

          • memory/2228-6-0x0000000004980000-0x00000000049C0000-memory.dmp

            Filesize

            256KB

          • memory/2228-7-0x0000000004980000-0x00000000049C0000-memory.dmp

            Filesize

            256KB

          • memory/2228-8-0x0000000002400000-0x0000000002444000-memory.dmp

            Filesize

            272KB

          • memory/2228-9-0x0000000004980000-0x00000000049C0000-memory.dmp

            Filesize

            256KB

          • memory/2228-10-0x0000000000400000-0x00000000004DB000-memory.dmp

            Filesize

            876KB

          • memory/2228-11-0x0000000074610000-0x0000000074CFE000-memory.dmp

            Filesize

            6.9MB