Analysis

  • max time kernel
    147s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    06/04/2024, 09:43

General

  • Target

    e1a868fa9783bf728ea755a356a51243_JaffaCakes118.exe

  • Size

    4.7MB

  • MD5

    e1a868fa9783bf728ea755a356a51243

  • SHA1

    485d477216db17721bc5e12ad88294048fbc744a

  • SHA256

    a3008a9b896e06ec41b0e73ecd41030be73c5134c6a37272690de77bb0edf80c

  • SHA512

    cde498572c247203d10b0d0cdb58c75180714a31fe04208227d74c5ec76c9fea4612ca666aab7b09b58b932207d555a0ee2a5462b5e8a25c3ede2b81841c1e71

  • SSDEEP

    98304:IL9fruNRPSE1HsEumburEDOwOokXRBtOXRotZqCmg36mH:r/PVQrCHJmRB6otc836

Malware Config

Extracted

Family

redline

Botnet

@usernameP1P

C2

ananasalit.xyz:81

Attributes
  • auth_value

    55d48a1a930cf4d6f3e2d6bcd0daaf07

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 3 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e1a868fa9783bf728ea755a356a51243_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e1a868fa9783bf728ea755a356a51243_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1948
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
        PID:2620

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1948-25-0x0000000000200000-0x0000000000201000-memory.dmp

            Filesize

            4KB

          • memory/1948-18-0x00000000001F0000-0x00000000001F1000-memory.dmp

            Filesize

            4KB

          • memory/1948-0-0x0000000000810000-0x0000000000CC2000-memory.dmp

            Filesize

            4.7MB

          • memory/1948-5-0x00000000001C0000-0x00000000001C1000-memory.dmp

            Filesize

            4KB

          • memory/1948-6-0x00000000001D0000-0x00000000001D1000-memory.dmp

            Filesize

            4KB

          • memory/1948-8-0x00000000001D0000-0x00000000001D1000-memory.dmp

            Filesize

            4KB

          • memory/1948-10-0x00000000001D0000-0x00000000001D1000-memory.dmp

            Filesize

            4KB

          • memory/1948-13-0x00000000001E0000-0x00000000001E1000-memory.dmp

            Filesize

            4KB

          • memory/1948-15-0x00000000001E0000-0x00000000001E1000-memory.dmp

            Filesize

            4KB

          • memory/1948-43-0x0000000000810000-0x0000000000CC2000-memory.dmp

            Filesize

            4.7MB

          • memory/1948-20-0x00000000001F0000-0x00000000001F1000-memory.dmp

            Filesize

            4KB

          • memory/1948-30-0x0000000000210000-0x0000000000211000-memory.dmp

            Filesize

            4KB

          • memory/1948-3-0x00000000001C0000-0x00000000001C1000-memory.dmp

            Filesize

            4KB

          • memory/1948-1-0x00000000001C0000-0x00000000001C1000-memory.dmp

            Filesize

            4KB

          • memory/1948-23-0x0000000000200000-0x0000000000201000-memory.dmp

            Filesize

            4KB

          • memory/1948-31-0x0000000000810000-0x0000000000CC2000-memory.dmp

            Filesize

            4.7MB

          • memory/1948-33-0x00000000000B0000-0x00000000001B0000-memory.dmp

            Filesize

            1024KB

          • memory/1948-28-0x0000000000210000-0x0000000000211000-memory.dmp

            Filesize

            4KB

          • memory/2620-46-0x0000000002530000-0x0000000002570000-memory.dmp

            Filesize

            256KB

          • memory/2620-40-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

            Filesize

            4KB

          • memory/2620-44-0x0000000000400000-0x0000000000422000-memory.dmp

            Filesize

            136KB

          • memory/2620-36-0x0000000000400000-0x0000000000422000-memory.dmp

            Filesize

            136KB

          • memory/2620-42-0x0000000000400000-0x0000000000422000-memory.dmp

            Filesize

            136KB

          • memory/2620-45-0x0000000074BA0000-0x000000007528E000-memory.dmp

            Filesize

            6.9MB

          • memory/2620-34-0x0000000000400000-0x0000000000422000-memory.dmp

            Filesize

            136KB

          • memory/2620-47-0x0000000074BA0000-0x000000007528E000-memory.dmp

            Filesize

            6.9MB

          • memory/2620-48-0x0000000002530000-0x0000000002570000-memory.dmp

            Filesize

            256KB