redline | b8e902d0a3a533b5a9f495f58c69692ae79917fbf9fa7829a9c52d4012e7a060

General

Target

e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe
Size

606KB
MD5

e2d959b36754b37727ef0c54b11ef3cf
SHA1

fffc93eec7deeda7d17ab729f89d4c5e01d781cf
SHA256

b8e902d0a3a533b5a9f495f58c69692ae79917fbf9fa7829a9c52d4012e7a060
SHA512

9a1b180bdba8fa4d0e4c8e9e3417653278d531811ac4cfe89ad988690e006bbb531824d4c1b5c94b07b1f7f98fa47d6b8a5c64a1be2818084e60e25c2b45c807
SSDEEP

12288:Wk0ryoZx5eA1GoeW6kZ5mW/tpy1UV5bO/Zj+t:LqB13eW

Score

10^/10

redline sectoprat nanani infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

NANani

C2

87.251.71.14:89

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1996-6-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1996-5-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1996-9-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1996-11-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1996-13-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1996-6-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/1996-5-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/1996-9-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/1996-11-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/1996-13-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

Suspicious use of SetThreadContext 1 IoCs

Processes:

e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe

description	pid	process	target process
PID 1932 set thread context of 1996	1932	e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe	e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 1996 e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	1996	e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe

description	pid	process	target process
PID 1932 wrote to memory of 1996	1932	e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe	e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe
PID 1932 wrote to memory of 1996	1932	e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe	e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe
PID 1932 wrote to memory of 1996	1932	e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe	e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe
PID 1932 wrote to memory of 1996	1932	e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe	e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe
PID 1932 wrote to memory of 1996	1932	e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe	e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe
PID 1932 wrote to memory of 1996	1932	e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe	e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe
PID 1932 wrote to memory of 1996	1932	e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe	e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe
PID 1932 wrote to memory of 1996	1932	e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe	e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe
PID 1932 wrote to memory of 1996	1932	e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe	e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1932

C:\Users\Admin\AppData\Local\Temp\e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1932-0-0x0000000001370000-0x000000000140E000-memory.dmp

Filesize
632KB

Download
memory/1932-1-0x0000000073F00000-0x00000000745EE000-memory.dmp

Filesize
6.9MB

Download
memory/1932-2-0x0000000004BF0000-0x0000000004C30000-memory.dmp

Filesize
256KB

Download
memory/1932-14-0x0000000073F00000-0x00000000745EE000-memory.dmp

Filesize
6.9MB

Download
memory/1996-5-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1996-6-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1996-3-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1996-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1996-9-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1996-11-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1996-13-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1996-4-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1996-15-0x0000000073F00000-0x00000000745EE000-memory.dmp

Filesize
6.9MB

Download
memory/1996-16-0x0000000000EB0000-0x0000000000EF0000-memory.dmp

Filesize
256KB

Download
memory/1996-17-0x0000000073F00000-0x00000000745EE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads