redline | b39700643a49b34390a19ee86bf2589e9b8ae96467526f096f5ad50c9788b5ee

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-04-2024 06:39

Target

ddc5e39d921c21e00aab97fbf1c5a9a9_JaffaCakes118.exe
Size

384KB
MD5

ddc5e39d921c21e00aab97fbf1c5a9a9
SHA1

9e038f28547520c97ccf8fdac0e73cf40602e7dd
SHA256

b39700643a49b34390a19ee86bf2589e9b8ae96467526f096f5ad50c9788b5ee
SHA512

c290639f2d0dda3dcd3350879b84238b1a11585f3b7bf63ebfa8fefecea930058d678a88f3fba678a8c3c4a7605a7dfb3410cd96abf8422168813d572aedc123
SSDEEP

6144:wMJSOG58rxWWuw52qrEoIP2vemenPPbBbSZ2NdxGn/dsqU:wAM8W6EfP22lnPPNi2NzG/djU

Score

10^/10

Family

redline

Botnet

usamoney

45.142.215.47:27643

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2956-6-0x00000000003C0000-0x00000000003E4000-memory.dmp	family_redline
behavioral1/memory/2956-9-0x0000000003330000-0x0000000003352000-memory.dmp	family_redline
behavioral1/memory/2956-16-0x00000000034A0000-0x00000000034E0000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2956-6-0x00000000003C0000-0x00000000003E4000-memory.dmp	family_sectoprat
behavioral1/memory/2956-7-0x00000000034A0000-0x00000000034E0000-memory.dmp	family_sectoprat
behavioral1/memory/2956-9-0x0000000003330000-0x0000000003352000-memory.dmp	family_sectoprat
behavioral1/memory/2956-10-0x00000000034A0000-0x00000000034E0000-memory.dmp	family_sectoprat
behavioral1/memory/2956-16-0x00000000034A0000-0x00000000034E0000-memory.dmp	family_sectoprat

C:\Users\Admin\AppData\Local\Temp\ddc5e39d921c21e00aab97fbf1c5a9a9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ddc5e39d921c21e00aab97fbf1c5a9a9_JaffaCakes118.exe"
1⤵
PID:2956

memory/2956-1-0x00000000017C0000-0x00000000018C0000-memory.dmp

Filesize
1024KB

Download
memory/2956-2-0x0000000000230000-0x0000000000260000-memory.dmp

Filesize
192KB

Download
memory/2956-3-0x0000000000400000-0x00000000016D3000-memory.dmp

Filesize
18.8MB

Download
memory/2956-4-0x0000000074120000-0x000000007480E000-memory.dmp

Filesize
6.9MB

Download
memory/2956-5-0x00000000034A0000-0x00000000034E0000-memory.dmp

Filesize
256KB

Download
memory/2956-6-0x00000000003C0000-0x00000000003E4000-memory.dmp

Filesize
144KB

Download
memory/2956-7-0x00000000034A0000-0x00000000034E0000-memory.dmp

Filesize
256KB

Download
memory/2956-8-0x00000000034A0000-0x00000000034E0000-memory.dmp

Filesize
256KB

Download
memory/2956-9-0x0000000003330000-0x0000000003352000-memory.dmp

Filesize
136KB

Download
memory/2956-10-0x00000000034A0000-0x00000000034E0000-memory.dmp

Filesize
256KB

Download
memory/2956-12-0x00000000017C0000-0x00000000018C0000-memory.dmp

Filesize
1024KB

Download
memory/2956-13-0x0000000074120000-0x000000007480E000-memory.dmp

Filesize
6.9MB

Download
memory/2956-15-0x00000000034A0000-0x00000000034E0000-memory.dmp

Filesize
256KB

Download
memory/2956-16-0x00000000034A0000-0x00000000034E0000-memory.dmp

Filesize
256KB

Download