redline | e96aefb8f07f72ece35d5ad8cb90adf4f5722c01b51664c6f99d6e2bbca3a5d3

Resubmissions

06/04/2024, 07:23

06/04/2024, 07:20

max time kernel
149s
max time network
164s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
06/04/2024, 07:23

Target

debc4398bfd38ad0fc3b66e930f643fa_JaffaCakes118.exe
Size

160KB
MD5

debc4398bfd38ad0fc3b66e930f643fa
SHA1

e71df8cc92449bcfd031bb85d5963e5e940ee1c9
SHA256

e96aefb8f07f72ece35d5ad8cb90adf4f5722c01b51664c6f99d6e2bbca3a5d3
SHA512

b24071cf94927bffc8017c18394862827151fcc1c393b4e2ca7e2c998e8fceee03544409f30fbbd0bc1a9ccc282b4f55e010412859307bba17d88c9a1133465a
SSDEEP

3072:TvqZ7ysn9tAbDL9qSbNR/5hYtABQGjHH7s0yOznBYd46B2mCkPi:jA7yZRNLhWANHH7OOziSO2mQ

Score

10^/10

Family

redline

Botnet

@aye22844

51.254.69.209:48987

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/4556-3-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/4556-3-0x0000000000400000-0x0000000000422000-memory.dmp	family_sectoprat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1904 set thread context of 4556	1904	debc4398bfd38ad0fc3b66e930f643fa_JaffaCakes118.exe	80

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1904	debc4398bfd38ad0fc3b66e930f643fa_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1904	debc4398bfd38ad0fc3b66e930f643fa_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 4556	1904	debc4398bfd38ad0fc3b66e930f643fa_JaffaCakes118.exe	80
PID 1904 wrote to memory of 4556	1904	debc4398bfd38ad0fc3b66e930f643fa_JaffaCakes118.exe	80
PID 1904 wrote to memory of 4556	1904	debc4398bfd38ad0fc3b66e930f643fa_JaffaCakes118.exe	80
PID 1904 wrote to memory of 4556	1904	debc4398bfd38ad0fc3b66e930f643fa_JaffaCakes118.exe	80
PID 1904 wrote to memory of 4556	1904	debc4398bfd38ad0fc3b66e930f643fa_JaffaCakes118.exe	80
PID 1904 wrote to memory of 4556	1904	debc4398bfd38ad0fc3b66e930f643fa_JaffaCakes118.exe	80
PID 1904 wrote to memory of 4556	1904	debc4398bfd38ad0fc3b66e930f643fa_JaffaCakes118.exe	80
PID 1904 wrote to memory of 4556	1904	debc4398bfd38ad0fc3b66e930f643fa_JaffaCakes118.exe	80

C:\Users\Admin\AppData\Local\Temp\debc4398bfd38ad0fc3b66e930f643fa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\debc4398bfd38ad0fc3b66e930f643fa_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  #cmd
  2⤵
  PID:4556

memory/1904-5-0x00007FF9E6170000-0x00007FF9E6C32000-memory.dmp

Filesize
10.8MB

Download
memory/1904-1-0x00007FF9E6170000-0x00007FF9E6C32000-memory.dmp

Filesize
10.8MB

Download
memory/1904-2-0x000000001B2C0000-0x000000001B2D0000-memory.dmp

Filesize
64KB

Download
memory/1904-0-0x00000000006C0000-0x00000000006EA000-memory.dmp

Filesize
168KB

Download
memory/4556-7-0x0000000005770000-0x0000000005D88000-memory.dmp

Filesize
6.1MB

Download
memory/4556-6-0x00000000749C0000-0x0000000075171000-memory.dmp

Filesize
7.7MB

Download
memory/4556-3-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4556-8-0x00000000051C0000-0x00000000051D2000-memory.dmp

Filesize
72KB

Download
memory/4556-9-0x00000000052F0000-0x00000000053FA000-memory.dmp

Filesize
1.0MB

Download
memory/4556-10-0x0000000005250000-0x000000000528C000-memory.dmp

Filesize
240KB

Download
memory/4556-11-0x0000000005240000-0x0000000005250000-memory.dmp

Filesize
64KB

Download
memory/4556-12-0x0000000005290000-0x00000000052DC000-memory.dmp

Filesize
304KB

Download
memory/4556-13-0x00000000749C0000-0x0000000075171000-memory.dmp

Filesize
7.7MB

Download
memory/4556-14-0x0000000005240000-0x0000000005250000-memory.dmp

Filesize
64KB

Download