redline | 63aeea2e1788244b1b8fb656312a94129b390faf6aeca5f7b06f53e26a505825

Analysis

max time kernel
143s
max time network
150s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
06-04-2024 06:19

Target

dd667ab0c1702dbf45e053f787fd521f_JaffaCakes118.exe
Size

366KB
MD5

dd667ab0c1702dbf45e053f787fd521f
SHA1

8578b45448b3d83e1bfa5a0c4653f6999bcc0034
SHA256

63aeea2e1788244b1b8fb656312a94129b390faf6aeca5f7b06f53e26a505825
SHA512

7e9953b8fbd52f699646affbecc3ea9bf91f9b26d93139c8d0c3d2988adb22763809545f7cb2fcbe35057b6185c37e1305da4033db27682da379695a36daf5c9
SSDEEP

6144:nRc2DNDMBl50qO3XKPK+Uh7ECNA3Oh/yhBcKCGEG7v5ofy1T:KuAF0P3XjtECu3Oh/yh7CGEGDWfy

Score

10^/10

Family

redline

Botnet

shop

45.9.20.107:46187

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1720-6-0x0000000000360000-0x0000000000384000-memory.dmp	family_redline
behavioral1/memory/1720-8-0x0000000003070000-0x0000000003092000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1720-6-0x0000000000360000-0x0000000000384000-memory.dmp	family_sectoprat
behavioral1/memory/1720-8-0x0000000003070000-0x0000000003092000-memory.dmp	family_sectoprat

C:\Users\Admin\AppData\Local\Temp\dd667ab0c1702dbf45e053f787fd521f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dd667ab0c1702dbf45e053f787fd521f_JaffaCakes118.exe"
1⤵
PID:1720

memory/1720-1-0x00000000018A0000-0x00000000019A0000-memory.dmp

Filesize
1024KB

Download
memory/1720-2-0x0000000000230000-0x0000000000260000-memory.dmp

Filesize
192KB

Download
memory/1720-3-0x0000000000400000-0x00000000016CE000-memory.dmp

Filesize
18.8MB

Download
memory/1720-4-0x0000000074890000-0x0000000074F7E000-memory.dmp

Filesize
6.9MB

Download
memory/1720-5-0x00000000033C0000-0x0000000003400000-memory.dmp

Filesize
256KB

Download
memory/1720-6-0x0000000000360000-0x0000000000384000-memory.dmp

Filesize
144KB

Download
memory/1720-7-0x00000000033C0000-0x0000000003400000-memory.dmp

Filesize
256KB

Download
memory/1720-8-0x0000000003070000-0x0000000003092000-memory.dmp

Filesize
136KB

Download
memory/1720-10-0x00000000018A0000-0x00000000019A0000-memory.dmp

Filesize
1024KB

Download
memory/1720-11-0x0000000074890000-0x0000000074F7E000-memory.dmp

Filesize
6.9MB

Download
memory/1720-13-0x00000000033C0000-0x0000000003400000-memory.dmp

Filesize
256KB

Download
memory/1720-14-0x00000000033C0000-0x0000000003400000-memory.dmp

Filesize
256KB

Download