Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06/04/2024, 12:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e28ad0bdecf2d01738905d2671e21b0f_JaffaCakes118.exe
Resource
win7-20240221-en
7 signatures
150 seconds
General
-
Target
e28ad0bdecf2d01738905d2671e21b0f_JaffaCakes118.exe
-
Size
587KB
-
MD5
e28ad0bdecf2d01738905d2671e21b0f
-
SHA1
d35461f8ffa2391517ed46a32d9fc8fe9baa9e14
-
SHA256
e95767ddcb06f45cdec003a051cb78f551313c70555600d94ec7676fc785c874
-
SHA512
a87eaafde4d0805aa91898bdf1f8e75baa0ca42659c2b3e2ee7a84bdc4dea7290e1673cf8d0662b37739e601cc2d9e2bc72fef7d4a4086c5f3875a3770817af1
-
SSDEEP
12288:5k+r8WL6FriXu93CQ5eA1GoOVzPqHESk1gnfLJeNuyZMoZjC1dVTbO/CbDmk:+WS13m0
Malware Config
Extracted
Family
redline
Botnet
ls5
C2
goryolinia.xyz:80
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
resource yara_rule behavioral1/memory/2764-6-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2764-5-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2764-9-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2764-11-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2764-13-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SectopRAT payload 5 IoCs
resource yara_rule behavioral1/memory/2764-6-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2764-5-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2764-9-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2764-11-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2764-13-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2196 set thread context of 2764 2196 e28ad0bdecf2d01738905d2671e21b0f_JaffaCakes118.exe 29 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2764 e28ad0bdecf2d01738905d2671e21b0f_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2196 wrote to memory of 2764 2196 e28ad0bdecf2d01738905d2671e21b0f_JaffaCakes118.exe 29 PID 2196 wrote to memory of 2764 2196 e28ad0bdecf2d01738905d2671e21b0f_JaffaCakes118.exe 29 PID 2196 wrote to memory of 2764 2196 e28ad0bdecf2d01738905d2671e21b0f_JaffaCakes118.exe 29 PID 2196 wrote to memory of 2764 2196 e28ad0bdecf2d01738905d2671e21b0f_JaffaCakes118.exe 29 PID 2196 wrote to memory of 2764 2196 e28ad0bdecf2d01738905d2671e21b0f_JaffaCakes118.exe 29 PID 2196 wrote to memory of 2764 2196 e28ad0bdecf2d01738905d2671e21b0f_JaffaCakes118.exe 29 PID 2196 wrote to memory of 2764 2196 e28ad0bdecf2d01738905d2671e21b0f_JaffaCakes118.exe 29 PID 2196 wrote to memory of 2764 2196 e28ad0bdecf2d01738905d2671e21b0f_JaffaCakes118.exe 29 PID 2196 wrote to memory of 2764 2196 e28ad0bdecf2d01738905d2671e21b0f_JaffaCakes118.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\e28ad0bdecf2d01738905d2671e21b0f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e28ad0bdecf2d01738905d2671e21b0f_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\e28ad0bdecf2d01738905d2671e21b0f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\e28ad0bdecf2d01738905d2671e21b0f_JaffaCakes118.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2764
-