Analysis

  • max time kernel
    132s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    06/04/2024, 09:35

General

  • Target

    e180347578de3564e7dea536a9af509b_JaffaCakes118.exe

  • Size

    592KB

  • MD5

    e180347578de3564e7dea536a9af509b

  • SHA1

    3dd9e99d7088a1d54e5b43cd065a2b4d0b38ac13

  • SHA256

    393d7ddd34d8d91c29a94de6f2c0a648deafd20c851d478e0073cd9430a96554

  • SHA512

    b9dd2fc75a52abe9012ad588ba95ff4e61082689e701fb8e164f9149cbe5fcfc90452e99cc18a580173f231c9ed148a95ffeb5ec06329760cfb65ed50c2eff59

  • SSDEEP

    12288:pANwRo+mv8QD4+0V1627qqB3AtJQFKUZE+RTnyL6FpUmWGPTXeBhcqlMhVkyoF8K:pAT8QE+kAqBTC+Zny0rSBh3SVtoFB

Malware Config

Extracted

Family

redline

Botnet

Live

C2

18.118.84.99:1050

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e180347578de3564e7dea536a9af509b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e180347578de3564e7dea536a9af509b_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:332
    • C:\Program Files (x86)\SmartPDF\SmartPDF\Setup.exe
      "C:\Program Files (x86)\SmartPDF\SmartPDF\Setup.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2684
      • C:\Users\Admin\AppData\Local\Temp\SMart.exe
        "C:\Users\Admin\AppData\Local\Temp\SMart.exe"
        3⤵
        • Executes dropped EXE
        PID:2932
    • C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe
      "C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2732
      • C:\Users\Admin\AppData\Local\Temp\is-P464M.tmp\stats.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-P464M.tmp\stats.tmp" /SL5="$301F0,138429,56832,C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        PID:2880

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\SmartPDF\SmartPDF\Setup.exe

          Filesize

          64KB

          MD5

          e4ce3b2f37e7ba8cdd28e00cb79c8db9

          SHA1

          5d74e57477afc66a0578d1227de9d9e28bd588d5

          SHA256

          a13daef3e2de76cb00b9a746e75eaf1226fe5a2f2be98b80162c173b2005a33b

          SHA512

          5b0fd9f3385768e9a3590aa908ea09caa9ca8cdd2c4e0f7064ceddd85c61df5c0144e6751394fa850dfd090377bd7c6701206fa52133c75486128443f99385f3

        • C:\Users\Admin\AppData\Local\Temp\SMart.exe

          Filesize

          116KB

          MD5

          2133233e31518892b3937fef038453ab

          SHA1

          d30104d49b739a5c2b426f22c5068251959684d2

          SHA256

          30057b4659a3b3ebc5e10e67f0f09511ecdd1a501cd2d3bfafc8c64518306e2b

          SHA512

          848525726422a75d6a0821d4342a0443bf6113fc308d0c3f4157cf17664aecd22b53bf47083299556b83352b9ad55dfe587c1e03b01444eb9a457834601c0c1c

        • \Program Files (x86)\SmartPDF\SmartPDF\stats.exe

          Filesize

          380KB

          MD5

          266395599ca5e0a6b0cb2fc0dea283b5

          SHA1

          990164b2f7646b38fc8a4abf62c3cc1d64f8839d

          SHA256

          99d12483e75a7615286e49e3df257033f8365431d57258ef763976cd1c2c2577

          SHA512

          0637b8a1074dee57b3611c6594a0ee4259415538d39203c086d5d80eb5e01ef5e29205c692d1abeb7585c91a4efaa53083aa72ae1288713fab9767862350cf38

        • \Users\Admin\AppData\Local\Temp\is-1FMER.tmp\_isetup\_shfoldr.dll

          Filesize

          22KB

          MD5

          92dc6ef532fbb4a5c3201469a5b5eb63

          SHA1

          3e89ff837147c16b4e41c30d6c796374e0b8e62c

          SHA256

          9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

          SHA512

          9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

        • \Users\Admin\AppData\Local\Temp\is-1FMER.tmp\itdownload.dll

          Filesize

          200KB

          MD5

          d82a429efd885ca0f324dd92afb6b7b8

          SHA1

          86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

          SHA256

          b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

          SHA512

          5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

        • \Users\Admin\AppData\Local\Temp\is-P464M.tmp\stats.tmp

          Filesize

          694KB

          MD5

          ffcf263a020aa7794015af0edee5df0b

          SHA1

          bce1eb5f0efb2c83f416b1782ea07c776666fdab

          SHA256

          1d07cfb7104b85fc0dffd761f6848ad176117e146bbb4079fe993efa06b94c64

          SHA512

          49f2b062adfb99c0c7f1012c56f0b52a8850d9f030cc32073b90025b372e4eb373f06a351e9b33264967427b8174c060c8a6110979f0eaf0872f7da6d5e4308a

        • memory/332-25-0x0000000000400000-0x0000000000433000-memory.dmp

          Filesize

          204KB

        • memory/2684-66-0x00000000003D0000-0x0000000000450000-memory.dmp

          Filesize

          512KB

        • memory/2684-41-0x0000000000D10000-0x0000000000D26000-memory.dmp

          Filesize

          88KB

        • memory/2684-88-0x00000000003D0000-0x0000000000450000-memory.dmp

          Filesize

          512KB

        • memory/2684-46-0x000007FEF5750000-0x000007FEF613C000-memory.dmp

          Filesize

          9.9MB

        • memory/2684-87-0x000007FEF5750000-0x000007FEF613C000-memory.dmp

          Filesize

          9.9MB

        • memory/2684-67-0x00000000003D0000-0x0000000000450000-memory.dmp

          Filesize

          512KB

        • memory/2732-29-0x0000000000400000-0x0000000000414000-memory.dmp

          Filesize

          80KB

        • memory/2732-78-0x0000000000400000-0x0000000000414000-memory.dmp

          Filesize

          80KB

        • memory/2732-86-0x0000000000400000-0x0000000000414000-memory.dmp

          Filesize

          80KB

        • memory/2732-26-0x0000000000400000-0x0000000000414000-memory.dmp

          Filesize

          80KB

        • memory/2880-56-0x0000000002260000-0x0000000002261000-memory.dmp

          Filesize

          4KB

        • memory/2880-63-0x0000000003850000-0x0000000003851000-memory.dmp

          Filesize

          4KB

        • memory/2880-59-0x0000000003810000-0x0000000003811000-memory.dmp

          Filesize

          4KB

        • memory/2880-58-0x0000000003800000-0x0000000003801000-memory.dmp

          Filesize

          4KB

        • memory/2880-57-0x00000000037F0000-0x00000000037F1000-memory.dmp

          Filesize

          4KB

        • memory/2880-62-0x0000000003840000-0x0000000003841000-memory.dmp

          Filesize

          4KB

        • memory/2880-55-0x0000000002250000-0x0000000002251000-memory.dmp

          Filesize

          4KB

        • memory/2880-54-0x0000000002240000-0x0000000002241000-memory.dmp

          Filesize

          4KB

        • memory/2880-52-0x0000000002220000-0x0000000002221000-memory.dmp

          Filesize

          4KB

        • memory/2880-51-0x0000000002210000-0x0000000002211000-memory.dmp

          Filesize

          4KB

        • memory/2880-49-0x00000000021F0000-0x00000000021F1000-memory.dmp

          Filesize

          4KB

        • memory/2880-48-0x0000000002030000-0x0000000002031000-memory.dmp

          Filesize

          4KB

        • memory/2880-47-0x0000000002020000-0x0000000002021000-memory.dmp

          Filesize

          4KB

        • memory/2880-60-0x0000000003820000-0x0000000003821000-memory.dmp

          Filesize

          4KB

        • memory/2880-65-0x0000000000240000-0x0000000000241000-memory.dmp

          Filesize

          4KB

        • memory/2880-64-0x0000000003860000-0x0000000003861000-memory.dmp

          Filesize

          4KB

        • memory/2880-44-0x0000000001FA0000-0x0000000001FDC000-memory.dmp

          Filesize

          240KB

        • memory/2880-50-0x0000000002200000-0x0000000002201000-memory.dmp

          Filesize

          4KB

        • memory/2880-53-0x0000000002230000-0x0000000002231000-memory.dmp

          Filesize

          4KB

        • memory/2880-61-0x0000000003830000-0x0000000003831000-memory.dmp

          Filesize

          4KB

        • memory/2880-79-0x0000000000400000-0x00000000004BD000-memory.dmp

          Filesize

          756KB

        • memory/2880-80-0x0000000001FA0000-0x0000000001FDC000-memory.dmp

          Filesize

          240KB

        • memory/2880-84-0x0000000000400000-0x00000000004BD000-memory.dmp

          Filesize

          756KB

        • memory/2932-77-0x00000000009F0000-0x0000000000A30000-memory.dmp

          Filesize

          256KB

        • memory/2932-76-0x00000000739E0000-0x00000000740CE000-memory.dmp

          Filesize

          6.9MB

        • memory/2932-75-0x0000000000ED0000-0x0000000000EF2000-memory.dmp

          Filesize

          136KB

        • memory/2932-89-0x00000000739E0000-0x00000000740CE000-memory.dmp

          Filesize

          6.9MB