Analysis

  • max time kernel
    146s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240319-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/04/2024, 09:35

General

  • Target

    e180347578de3564e7dea536a9af509b_JaffaCakes118.exe

  • Size

    592KB

  • MD5

    e180347578de3564e7dea536a9af509b

  • SHA1

    3dd9e99d7088a1d54e5b43cd065a2b4d0b38ac13

  • SHA256

    393d7ddd34d8d91c29a94de6f2c0a648deafd20c851d478e0073cd9430a96554

  • SHA512

    b9dd2fc75a52abe9012ad588ba95ff4e61082689e701fb8e164f9149cbe5fcfc90452e99cc18a580173f231c9ed148a95ffeb5ec06329760cfb65ed50c2eff59

  • SSDEEP

    12288:pANwRo+mv8QD4+0V1627qqB3AtJQFKUZE+RTnyL6FpUmWGPTXeBhcqlMhVkyoF8K:pAT8QE+kAqBTC+Zny0rSBh3SVtoFB

Malware Config

Extracted

Family

redline

Botnet

Live

C2

18.118.84.99:1050

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 2 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Script User-Agent 3 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e180347578de3564e7dea536a9af509b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e180347578de3564e7dea536a9af509b_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:3460
    • C:\Program Files (x86)\SmartPDF\SmartPDF\Setup.exe
      "C:\Program Files (x86)\SmartPDF\SmartPDF\Setup.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3772
      • C:\Users\Admin\AppData\Local\Temp\SMart.exe
        "C:\Users\Admin\AppData\Local\Temp\SMart.exe"
        3⤵
        • Executes dropped EXE
        PID:400
    • C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe
      "C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4376
      • C:\Users\Admin\AppData\Local\Temp\is-7GE0Q.tmp\stats.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-7GE0Q.tmp\stats.tmp" /SL5="$901F8,138429,56832,C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        PID:3156
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=2260,i,4762972005863767630,9297428255150568035,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:1072

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\SmartPDF\SmartPDF\Setup.exe

            Filesize

            64KB

            MD5

            e4ce3b2f37e7ba8cdd28e00cb79c8db9

            SHA1

            5d74e57477afc66a0578d1227de9d9e28bd588d5

            SHA256

            a13daef3e2de76cb00b9a746e75eaf1226fe5a2f2be98b80162c173b2005a33b

            SHA512

            5b0fd9f3385768e9a3590aa908ea09caa9ca8cdd2c4e0f7064ceddd85c61df5c0144e6751394fa850dfd090377bd7c6701206fa52133c75486128443f99385f3

          • C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe

            Filesize

            380KB

            MD5

            266395599ca5e0a6b0cb2fc0dea283b5

            SHA1

            990164b2f7646b38fc8a4abf62c3cc1d64f8839d

            SHA256

            99d12483e75a7615286e49e3df257033f8365431d57258ef763976cd1c2c2577

            SHA512

            0637b8a1074dee57b3611c6594a0ee4259415538d39203c086d5d80eb5e01ef5e29205c692d1abeb7585c91a4efaa53083aa72ae1288713fab9767862350cf38

          • C:\Users\Admin\AppData\Local\Temp\SMart.exe

            Filesize

            116KB

            MD5

            2133233e31518892b3937fef038453ab

            SHA1

            d30104d49b739a5c2b426f22c5068251959684d2

            SHA256

            30057b4659a3b3ebc5e10e67f0f09511ecdd1a501cd2d3bfafc8c64518306e2b

            SHA512

            848525726422a75d6a0821d4342a0443bf6113fc308d0c3f4157cf17664aecd22b53bf47083299556b83352b9ad55dfe587c1e03b01444eb9a457834601c0c1c

          • C:\Users\Admin\AppData\Local\Temp\is-7GE0Q.tmp\stats.tmp

            Filesize

            694KB

            MD5

            ffcf263a020aa7794015af0edee5df0b

            SHA1

            bce1eb5f0efb2c83f416b1782ea07c776666fdab

            SHA256

            1d07cfb7104b85fc0dffd761f6848ad176117e146bbb4079fe993efa06b94c64

            SHA512

            49f2b062adfb99c0c7f1012c56f0b52a8850d9f030cc32073b90025b372e4eb373f06a351e9b33264967427b8174c060c8a6110979f0eaf0872f7da6d5e4308a

          • C:\Users\Admin\AppData\Local\Temp\is-H0AR9.tmp\itdownload.dll

            Filesize

            200KB

            MD5

            d82a429efd885ca0f324dd92afb6b7b8

            SHA1

            86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

            SHA256

            b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

            SHA512

            5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

          • memory/400-138-0x0000000005120000-0x0000000005738000-memory.dmp

            Filesize

            6.1MB

          • memory/400-136-0x0000000000160000-0x0000000000182000-memory.dmp

            Filesize

            136KB

          • memory/400-155-0x0000000004F30000-0x0000000004F40000-memory.dmp

            Filesize

            64KB

          • memory/400-154-0x0000000072EE0000-0x0000000073690000-memory.dmp

            Filesize

            7.7MB

          • memory/400-143-0x0000000004BD0000-0x0000000004C1C000-memory.dmp

            Filesize

            304KB

          • memory/400-142-0x0000000004B90000-0x0000000004BCC000-memory.dmp

            Filesize

            240KB

          • memory/400-141-0x0000000004F30000-0x0000000004F40000-memory.dmp

            Filesize

            64KB

          • memory/400-140-0x0000000004C60000-0x0000000004D6A000-memory.dmp

            Filesize

            1.0MB

          • memory/400-139-0x0000000004B30000-0x0000000004B42000-memory.dmp

            Filesize

            72KB

          • memory/400-137-0x0000000072EE0000-0x0000000073690000-memory.dmp

            Filesize

            7.7MB

          • memory/3156-108-0x0000000005F10000-0x0000000005F11000-memory.dmp

            Filesize

            4KB

          • memory/3156-124-0x0000000006020000-0x0000000006021000-memory.dmp

            Filesize

            4KB

          • memory/3156-121-0x0000000005FF0000-0x0000000005FF1000-memory.dmp

            Filesize

            4KB

          • memory/3156-116-0x0000000005FA0000-0x0000000005FA1000-memory.dmp

            Filesize

            4KB

          • memory/3156-111-0x0000000005F50000-0x0000000005F51000-memory.dmp

            Filesize

            4KB

          • memory/3156-120-0x0000000005FE0000-0x0000000005FE1000-memory.dmp

            Filesize

            4KB

          • memory/3156-113-0x0000000005F70000-0x0000000005F71000-memory.dmp

            Filesize

            4KB

          • memory/3156-114-0x0000000005F80000-0x0000000005F81000-memory.dmp

            Filesize

            4KB

          • memory/3156-115-0x0000000005F90000-0x0000000005F91000-memory.dmp

            Filesize

            4KB

          • memory/3156-117-0x0000000005FB0000-0x0000000005FB1000-memory.dmp

            Filesize

            4KB

          • memory/3156-119-0x0000000005FD0000-0x0000000005FD1000-memory.dmp

            Filesize

            4KB

          • memory/3156-118-0x0000000005FC0000-0x0000000005FC1000-memory.dmp

            Filesize

            4KB

          • memory/3156-147-0x0000000000400000-0x00000000004BD000-memory.dmp

            Filesize

            756KB

          • memory/3156-112-0x0000000005F60000-0x0000000005F61000-memory.dmp

            Filesize

            4KB

          • memory/3156-110-0x0000000005F40000-0x0000000005F41000-memory.dmp

            Filesize

            4KB

          • memory/3156-123-0x0000000006010000-0x0000000006011000-memory.dmp

            Filesize

            4KB

          • memory/3156-122-0x0000000006000000-0x0000000006001000-memory.dmp

            Filesize

            4KB

          • memory/3156-109-0x0000000005F20000-0x0000000005F21000-memory.dmp

            Filesize

            4KB

          • memory/3156-125-0x0000000005F30000-0x0000000005F31000-memory.dmp

            Filesize

            4KB

          • memory/3156-56-0x0000000003950000-0x000000000398C000-memory.dmp

            Filesize

            240KB

          • memory/3156-51-0x0000000000660000-0x0000000000661000-memory.dmp

            Filesize

            4KB

          • memory/3460-34-0x0000000000400000-0x0000000000433000-memory.dmp

            Filesize

            204KB

          • memory/3772-151-0x000000001B1D0000-0x000000001B1E0000-memory.dmp

            Filesize

            64KB

          • memory/3772-37-0x00007FF9BBF30000-0x00007FF9BC9F1000-memory.dmp

            Filesize

            10.8MB

          • memory/3772-40-0x000000001B1D0000-0x000000001B1E0000-memory.dmp

            Filesize

            64KB

          • memory/3772-41-0x000000001B1D0000-0x000000001B1E0000-memory.dmp

            Filesize

            64KB

          • memory/3772-150-0x00007FF9BBF30000-0x00007FF9BC9F1000-memory.dmp

            Filesize

            10.8MB

          • memory/3772-30-0x0000000000370000-0x0000000000386000-memory.dmp

            Filesize

            88KB

          • memory/3772-152-0x000000001B1D0000-0x000000001B1E0000-memory.dmp

            Filesize

            64KB

          • memory/3772-153-0x000000001B1D0000-0x000000001B1E0000-memory.dmp

            Filesize

            64KB

          • memory/3772-42-0x000000001B1D0000-0x000000001B1E0000-memory.dmp

            Filesize

            64KB

          • memory/3772-43-0x000000001B1D0000-0x000000001B1E0000-memory.dmp

            Filesize

            64KB

          • memory/4376-35-0x0000000000400000-0x0000000000414000-memory.dmp

            Filesize

            80KB

          • memory/4376-44-0x0000000000400000-0x0000000000414000-memory.dmp

            Filesize

            80KB

          • memory/4376-149-0x0000000000400000-0x0000000000414000-memory.dmp

            Filesize

            80KB