Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/04/2024, 09:43

General

  • Target

    e1a868fa9783bf728ea755a356a51243_JaffaCakes118.exe

  • Size

    4.7MB

  • MD5

    e1a868fa9783bf728ea755a356a51243

  • SHA1

    485d477216db17721bc5e12ad88294048fbc744a

  • SHA256

    a3008a9b896e06ec41b0e73ecd41030be73c5134c6a37272690de77bb0edf80c

  • SHA512

    cde498572c247203d10b0d0cdb58c75180714a31fe04208227d74c5ec76c9fea4612ca666aab7b09b58b932207d555a0ee2a5462b5e8a25c3ede2b81841c1e71

  • SSDEEP

    98304:IL9fruNRPSE1HsEumburEDOwOokXRBtOXRotZqCmg36mH:r/PVQrCHJmRB6otc836

Malware Config

Extracted

Family

redline

Botnet

@usernameP1P

C2

ananasalit.xyz:81

Attributes
  • auth_value

    55d48a1a930cf4d6f3e2d6bcd0daaf07

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e1a868fa9783bf728ea755a356a51243_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e1a868fa9783bf728ea755a356a51243_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2840
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
        PID:3420
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 276
        2⤵
        • Program crash
        PID:2944
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2840 -ip 2840
      1⤵
        PID:2288

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/2840-0-0x0000000001620000-0x0000000001621000-memory.dmp

              Filesize

              4KB

            • memory/2840-2-0x0000000001740000-0x0000000001741000-memory.dmp

              Filesize

              4KB

            • memory/2840-1-0x0000000000C20000-0x00000000010D2000-memory.dmp

              Filesize

              4.7MB

            • memory/2840-3-0x0000000001770000-0x0000000001771000-memory.dmp

              Filesize

              4KB

            • memory/2840-4-0x0000000001780000-0x0000000001781000-memory.dmp

              Filesize

              4KB

            • memory/2840-6-0x00000000017A0000-0x00000000017A1000-memory.dmp

              Filesize

              4KB

            • memory/2840-5-0x0000000001790000-0x0000000001791000-memory.dmp

              Filesize

              4KB

            • memory/2840-7-0x0000000000C20000-0x00000000010D2000-memory.dmp

              Filesize

              4.7MB

            • memory/2840-9-0x0000000001400000-0x0000000001500000-memory.dmp

              Filesize

              1024KB

            • memory/2840-22-0x0000000000C20000-0x00000000010D2000-memory.dmp

              Filesize

              4.7MB

            • memory/3420-15-0x0000000074890000-0x0000000075040000-memory.dmp

              Filesize

              7.7MB

            • memory/3420-16-0x0000000005CE0000-0x00000000062F8000-memory.dmp

              Filesize

              6.1MB

            • memory/3420-17-0x0000000005770000-0x0000000005782000-memory.dmp

              Filesize

              72KB

            • memory/3420-18-0x00000000058E0000-0x00000000059EA000-memory.dmp

              Filesize

              1.0MB

            • memory/3420-19-0x0000000005B30000-0x0000000005B40000-memory.dmp

              Filesize

              64KB

            • memory/3420-20-0x0000000005810000-0x000000000584C000-memory.dmp

              Filesize

              240KB

            • memory/3420-21-0x0000000005850000-0x000000000589C000-memory.dmp

              Filesize

              304KB

            • memory/3420-10-0x0000000000400000-0x0000000000422000-memory.dmp

              Filesize

              136KB

            • memory/3420-23-0x0000000074890000-0x0000000075040000-memory.dmp

              Filesize

              7.7MB

            • memory/3420-24-0x0000000005B30000-0x0000000005B40000-memory.dmp

              Filesize

              64KB