Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/04/2024, 12:30

General

  • Target

    e28c1eb3901ebf8a350118119051a879_JaffaCakes118.exe

  • Size

    949KB

  • MD5

    e28c1eb3901ebf8a350118119051a879

  • SHA1

    499e2379b855f891b01d46375573b82f52eeaff8

  • SHA256

    a19cee0f8d7ce055c99ddfd266c56af0856771e6ad5989b4bcc279cbd780b070

  • SHA512

    610ebe54d3cc49754e7e91d2e96693ddb017e507367531824fc9b4a557625ea2a1d6afed6730a92517acf91111b3154323b9dbae0ecee3b9d61ed13c826a5129

  • SSDEEP

    12288:AGRi/B4pVZi9702Hwi+b5bt+Bx9NmWnYSseiz6UOWqHh33rONpg3/IzsqLACkjgc:RzVZHi+bNENm8cxO/Br0O3/IHLd0

Malware Config

Extracted

Family

redline

Botnet

@Scrymix

C2

45.129.236.209:42801

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e28c1eb3901ebf8a350118119051a879_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e28c1eb3901ebf8a350118119051a879_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4880
    • C:\Users\Admin\AppData\Local\Temp\e28c1eb3901ebf8a350118119051a879_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\e28c1eb3901ebf8a350118119051a879_JaffaCakes118.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1700

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\e28c1eb3901ebf8a350118119051a879_JaffaCakes118.exe.log

          Filesize

          1KB

          MD5

          17573558c4e714f606f997e5157afaac

          SHA1

          13e16e9415ceef429aaf124139671ebeca09ed23

          SHA256

          c18db6aecad2436da4a63ff26af4e3a337cca48f01c21b8db494fe5ccc60e553

          SHA512

          f4edf13f05a0d142e4dd42802098c8c44988ee8869621a62c2b565a77c9a95857f636583ff8d6d9baa366603d98b9bfbf1fc75bc6f9f8f83c80cb1215b2941cc

        • memory/1700-13-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/1700-25-0x0000000005800000-0x0000000005810000-memory.dmp

          Filesize

          64KB

        • memory/1700-24-0x0000000075280000-0x0000000075A30000-memory.dmp

          Filesize

          7.7MB

        • memory/1700-23-0x0000000008070000-0x000000000817A000-memory.dmp

          Filesize

          1.0MB

        • memory/1700-22-0x00000000065C0000-0x000000000660C000-memory.dmp

          Filesize

          304KB

        • memory/1700-21-0x0000000005800000-0x0000000005810000-memory.dmp

          Filesize

          64KB

        • memory/1700-20-0x0000000006480000-0x00000000064BC000-memory.dmp

          Filesize

          240KB

        • memory/1700-19-0x00000000056A0000-0x00000000056B2000-memory.dmp

          Filesize

          72KB

        • memory/1700-18-0x00000000067F0000-0x0000000006E08000-memory.dmp

          Filesize

          6.1MB

        • memory/1700-17-0x0000000075280000-0x0000000075A30000-memory.dmp

          Filesize

          7.7MB

        • memory/4880-6-0x0000000005400000-0x000000000540A000-memory.dmp

          Filesize

          40KB

        • memory/4880-7-0x0000000005760000-0x00000000057B6000-memory.dmp

          Filesize

          344KB

        • memory/4880-11-0x00000000068A0000-0x0000000006942000-memory.dmp

          Filesize

          648KB

        • memory/4880-10-0x0000000005810000-0x0000000005820000-memory.dmp

          Filesize

          64KB

        • memory/4880-16-0x0000000075280000-0x0000000075A30000-memory.dmp

          Filesize

          7.7MB

        • memory/4880-9-0x0000000075280000-0x0000000075A30000-memory.dmp

          Filesize

          7.7MB

        • memory/4880-8-0x0000000005820000-0x0000000005838000-memory.dmp

          Filesize

          96KB

        • memory/4880-12-0x00000000066A0000-0x00000000066D8000-memory.dmp

          Filesize

          224KB

        • memory/4880-1-0x0000000075280000-0x0000000075A30000-memory.dmp

          Filesize

          7.7MB

        • memory/4880-5-0x0000000005810000-0x0000000005820000-memory.dmp

          Filesize

          64KB

        • memory/4880-4-0x00000000055D0000-0x0000000005662000-memory.dmp

          Filesize

          584KB

        • memory/4880-3-0x0000000009F00000-0x000000000A4A4000-memory.dmp

          Filesize

          5.6MB

        • memory/4880-2-0x00000000098B0000-0x000000000994C000-memory.dmp

          Filesize

          624KB

        • memory/4880-0-0x00000000009C0000-0x0000000000AB2000-memory.dmp

          Filesize

          968KB