redline | 22436951c8057dd93d6d2da55a46c524151ba690a906f047582fc8aaa309e892

General

Target

de1fd0a630275b284af95ec3e386b7f0_JaffaCakes118.exe
Size

4.7MB
MD5

de1fd0a630275b284af95ec3e386b7f0
SHA1

e26ce8ea5d925ca5de4f7e6c321b6971788dc9c7
SHA256

22436951c8057dd93d6d2da55a46c524151ba690a906f047582fc8aaa309e892
SHA512

d649c27d3f1c382d1e1cfd10380637dd1c63123f253abb6b6b37c8f6e2ef1bec832111bfd0a32ab36ef30b57b898cbc5be09a0f0b320e27e9d7335c36e8886f5
SSDEEP

98304:4LrzJnnA7X2Cb/WQHffKxv6X0gCNAuCNPanPQ6DoB+NZj2sA7V9Nic:clnAOQ6VplixNPanTo8g7rZ

Score

10^/10

redline sectoprat 2047736222 infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

2047736222

C2

94.26.248.120:63731

Attributes

auth_value
ee8187fd574be73a935e073f8b5705eb

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

resource	yara_rule
behavioral1/memory/2692-35-0x0000000000090000-0x00000000000B2000-memory.dmp	family_redline
behavioral1/memory/2692-43-0x0000000000090000-0x00000000000B2000-memory.dmp	family_redline
behavioral1/memory/2692-41-0x0000000000090000-0x00000000000B2000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 3 IoCs

resource	yara_rule
behavioral1/memory/2692-35-0x0000000000090000-0x00000000000B2000-memory.dmp	family_sectoprat
behavioral1/memory/2692-43-0x0000000000090000-0x00000000000B2000-memory.dmp	family_sectoprat
behavioral1/memory/2692-41-0x0000000000090000-0x00000000000B2000-memory.dmp	family_sectoprat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2324 set thread context of 2692	2324	de1fd0a630275b284af95ec3e386b7f0_JaffaCakes118.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2324	de1fd0a630275b284af95ec3e386b7f0_JaffaCakes118.exe
2324	de1fd0a630275b284af95ec3e386b7f0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2692	2324	de1fd0a630275b284af95ec3e386b7f0_JaffaCakes118.exe	28
PID 2324 wrote to memory of 2692	2324	de1fd0a630275b284af95ec3e386b7f0_JaffaCakes118.exe	28
PID 2324 wrote to memory of 2692	2324	de1fd0a630275b284af95ec3e386b7f0_JaffaCakes118.exe	28
PID 2324 wrote to memory of 2692	2324	de1fd0a630275b284af95ec3e386b7f0_JaffaCakes118.exe	28
PID 2324 wrote to memory of 2692	2324	de1fd0a630275b284af95ec3e386b7f0_JaffaCakes118.exe	28
PID 2324 wrote to memory of 2692	2324	de1fd0a630275b284af95ec3e386b7f0_JaffaCakes118.exe	28
PID 2324 wrote to memory of 2692	2324	de1fd0a630275b284af95ec3e386b7f0_JaffaCakes118.exe	28
PID 2324 wrote to memory of 2692	2324	de1fd0a630275b284af95ec3e386b7f0_JaffaCakes118.exe	28
PID 2324 wrote to memory of 2692	2324	de1fd0a630275b284af95ec3e386b7f0_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\de1fd0a630275b284af95ec3e386b7f0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\de1fd0a630275b284af95ec3e386b7f0_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2324-25-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/2324-3-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2324-28-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2324-30-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2324-6-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/2324-10-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/2324-18-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2324-15-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2324-13-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2324-20-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2324-8-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/2324-23-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/2324-1-0x0000000001210000-0x00000000016BF000-memory.dmp

Filesize
4.7MB

Download
memory/2324-0-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2324-5-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2324-32-0x0000000000360000-0x0000000000460000-memory.dmp

Filesize
1024KB

Download
memory/2324-42-0x0000000001210000-0x00000000016BF000-memory.dmp

Filesize
4.7MB

Download
memory/2692-35-0x0000000000090000-0x00000000000B2000-memory.dmp

Filesize
136KB

Download
memory/2692-39-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2692-33-0x0000000000090000-0x00000000000B2000-memory.dmp

Filesize
136KB

Download
memory/2692-43-0x0000000000090000-0x00000000000B2000-memory.dmp

Filesize
136KB

Download
memory/2692-41-0x0000000000090000-0x00000000000B2000-memory.dmp

Filesize
136KB

Download
memory/2692-44-0x0000000073F30000-0x000000007461E000-memory.dmp

Filesize
6.9MB

Download
memory/2692-45-0x00000000048E0000-0x0000000004920000-memory.dmp

Filesize
256KB

Download
memory/2692-46-0x0000000073F30000-0x000000007461E000-memory.dmp

Filesize
6.9MB

Download
memory/2692-47-0x00000000048E0000-0x0000000004920000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing