Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05-04-2024 03:59
Static task
static1
Behavioral task
behavioral1
Sample
ca39ec8a3d9505d7f8f5bcf6eaf2ba9a_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
ca39ec8a3d9505d7f8f5bcf6eaf2ba9a_JaffaCakes118.exe
-
Size
426KB
-
MD5
ca39ec8a3d9505d7f8f5bcf6eaf2ba9a
-
SHA1
b1a1ba74b7f9e19b701fd3d99821f0bf43d1c334
-
SHA256
5648cc1b309ec1485e999c6c35e12071de6d142b1b0aa7c7b2b34f9a31b2531a
-
SHA512
93baffd210a55de3b7f97b81071747cd8fae44315e263227f0ec4a06bc7bb1229e27c27270b52ae71ef610f1bf37dc2947c5ae4f9217dc6db9b6dd3dbac79d6f
-
SSDEEP
12288:yOFtMQZvxXnjDoGjk7MfMwTLU0ErexeOjdW2wa:3FtHVdvoGjkoMFrexVp
Malware Config
Extracted
redline
paladin
37.228.129.48:29795
-
auth_value
f27db372188045eefdf974196ead3dae
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/840-6-0x0000000002640000-0x0000000002676000-memory.dmp family_redline behavioral2/memory/840-9-0x0000000002A20000-0x0000000002A52000-memory.dmp family_redline -
SectopRAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/840-6-0x0000000002640000-0x0000000002676000-memory.dmp family_sectoprat behavioral2/memory/840-7-0x00000000050C0000-0x00000000050D0000-memory.dmp family_sectoprat behavioral2/memory/840-9-0x0000000002A20000-0x0000000002A52000-memory.dmp family_sectoprat
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/840-1-0x0000000000A10000-0x0000000000B10000-memory.dmpFilesize
1024KB
-
memory/840-2-0x00000000023B0000-0x00000000023F3000-memory.dmpFilesize
268KB
-
memory/840-3-0x0000000000400000-0x000000000079C000-memory.dmpFilesize
3.6MB
-
memory/840-4-0x0000000074DA0000-0x0000000075550000-memory.dmpFilesize
7.7MB
-
memory/840-5-0x00000000050C0000-0x00000000050D0000-memory.dmpFilesize
64KB
-
memory/840-6-0x0000000002640000-0x0000000002676000-memory.dmpFilesize
216KB
-
memory/840-7-0x00000000050C0000-0x00000000050D0000-memory.dmpFilesize
64KB
-
memory/840-8-0x00000000050D0000-0x0000000005674000-memory.dmpFilesize
5.6MB
-
memory/840-9-0x0000000002A20000-0x0000000002A52000-memory.dmpFilesize
200KB
-
memory/840-10-0x0000000005680000-0x0000000005C98000-memory.dmpFilesize
6.1MB
-
memory/840-11-0x0000000004F30000-0x0000000004F42000-memory.dmpFilesize
72KB
-
memory/840-12-0x0000000004F50000-0x000000000505A000-memory.dmpFilesize
1.0MB
-
memory/840-13-0x00000000050C0000-0x00000000050D0000-memory.dmpFilesize
64KB
-
memory/840-14-0x0000000005060000-0x000000000509C000-memory.dmpFilesize
240KB
-
memory/840-15-0x0000000005CC0000-0x0000000005D0C000-memory.dmpFilesize
304KB
-
memory/840-17-0x00000000023B0000-0x00000000023F3000-memory.dmpFilesize
268KB
-
memory/840-18-0x0000000000A10000-0x0000000000B10000-memory.dmpFilesize
1024KB
-
memory/840-19-0x0000000074DA0000-0x0000000075550000-memory.dmpFilesize
7.7MB
-
memory/840-21-0x00000000050C0000-0x00000000050D0000-memory.dmpFilesize
64KB
-
memory/840-22-0x00000000050C0000-0x00000000050D0000-memory.dmpFilesize
64KB
-
memory/840-23-0x00000000050C0000-0x00000000050D0000-memory.dmpFilesize
64KB