redline | e96aefb8f07f72ece35d5ad8cb90adf4f5722c01b51664c6f99d6e2bbca3a5d3

Resubmissions

06/04/2024, 07:23

06/04/2024, 07:20

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2024, 07:20

Target

debc4398bfd38ad0fc3b66e930f643fa_JaffaCakes118.exe
Size

160KB
MD5

debc4398bfd38ad0fc3b66e930f643fa
SHA1

e71df8cc92449bcfd031bb85d5963e5e940ee1c9
SHA256

e96aefb8f07f72ece35d5ad8cb90adf4f5722c01b51664c6f99d6e2bbca3a5d3
SHA512

b24071cf94927bffc8017c18394862827151fcc1c393b4e2ca7e2c998e8fceee03544409f30fbbd0bc1a9ccc282b4f55e010412859307bba17d88c9a1133465a
SSDEEP

3072:TvqZ7ysn9tAbDL9qSbNR/5hYtABQGjHH7s0yOznBYd46B2mCkPi:jA7yZRNLhWANHH7OOziSO2mQ

Score

10^/10

Family

redline

Botnet

@aye22844

51.254.69.209:48987

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/3928-3-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/3928-3-0x0000000000400000-0x0000000000422000-memory.dmp	family_sectoprat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4476 set thread context of 3928	4476	debc4398bfd38ad0fc3b66e930f643fa_JaffaCakes118.exe	87

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4476	debc4398bfd38ad0fc3b66e930f643fa_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4476	debc4398bfd38ad0fc3b66e930f643fa_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 3928	4476	debc4398bfd38ad0fc3b66e930f643fa_JaffaCakes118.exe	87
PID 4476 wrote to memory of 3928	4476	debc4398bfd38ad0fc3b66e930f643fa_JaffaCakes118.exe	87
PID 4476 wrote to memory of 3928	4476	debc4398bfd38ad0fc3b66e930f643fa_JaffaCakes118.exe	87
PID 4476 wrote to memory of 3928	4476	debc4398bfd38ad0fc3b66e930f643fa_JaffaCakes118.exe	87
PID 4476 wrote to memory of 3928	4476	debc4398bfd38ad0fc3b66e930f643fa_JaffaCakes118.exe	87
PID 4476 wrote to memory of 3928	4476	debc4398bfd38ad0fc3b66e930f643fa_JaffaCakes118.exe	87
PID 4476 wrote to memory of 3928	4476	debc4398bfd38ad0fc3b66e930f643fa_JaffaCakes118.exe	87
PID 4476 wrote to memory of 3928	4476	debc4398bfd38ad0fc3b66e930f643fa_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\debc4398bfd38ad0fc3b66e930f643fa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\debc4398bfd38ad0fc3b66e930f643fa_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  #cmd
  2⤵
  PID:3928

memory/3928-7-0x0000000005B00000-0x0000000006118000-memory.dmp

Filesize
6.1MB

Download
memory/3928-11-0x0000000005600000-0x000000000563C000-memory.dmp

Filesize
240KB

Download
memory/3928-14-0x0000000005670000-0x0000000005680000-memory.dmp

Filesize
64KB

Download
memory/3928-3-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3928-8-0x0000000005560000-0x0000000005572000-memory.dmp

Filesize
72KB

Download
memory/3928-6-0x0000000074A20000-0x00000000751D0000-memory.dmp

Filesize
7.7MB

Download
memory/3928-9-0x00000000056D0000-0x00000000057DA000-memory.dmp

Filesize
1.0MB

Download
memory/3928-13-0x0000000074A20000-0x00000000751D0000-memory.dmp

Filesize
7.7MB

Download
memory/3928-12-0x0000000005680000-0x00000000056CC000-memory.dmp

Filesize
304KB

Download
memory/3928-10-0x0000000005670000-0x0000000005680000-memory.dmp

Filesize
64KB

Download
memory/4476-0-0x0000000000AF0000-0x0000000000B1A000-memory.dmp

Filesize
168KB

Download
memory/4476-1-0x00007FF849560000-0x00007FF84A021000-memory.dmp

Filesize
10.8MB

Download
memory/4476-5-0x00007FF849560000-0x00007FF84A021000-memory.dmp

Filesize
10.8MB

Download
memory/4476-2-0x0000000001340000-0x0000000001350000-memory.dmp

Filesize
64KB

Download