Analysis
-
max time kernel
138s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06/04/2024, 15:30
Static task
static1
Behavioral task
behavioral1
Sample
e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe
Resource
win7-20240319-en
General
-
Target
e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe
-
Size
606KB
-
MD5
e2d959b36754b37727ef0c54b11ef3cf
-
SHA1
fffc93eec7deeda7d17ab729f89d4c5e01d781cf
-
SHA256
b8e902d0a3a533b5a9f495f58c69692ae79917fbf9fa7829a9c52d4012e7a060
-
SHA512
9a1b180bdba8fa4d0e4c8e9e3417653278d531811ac4cfe89ad988690e006bbb531824d4c1b5c94b07b1f7f98fa47d6b8a5c64a1be2818084e60e25c2b45c807
-
SSDEEP
12288:Wk0ryoZx5eA1GoeW6kZ5mW/tpy1UV5bO/Zj+t:LqB13eW
Malware Config
Extracted
redline
NANani
87.251.71.14:89
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral2/memory/904-6-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SectopRAT payload 1 IoCs
resource yara_rule behavioral2/memory/904-6-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3032 set thread context of 904 3032 e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe 95 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 904 e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3032 wrote to memory of 904 3032 e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe 95 PID 3032 wrote to memory of 904 3032 e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe 95 PID 3032 wrote to memory of 904 3032 e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe 95 PID 3032 wrote to memory of 904 3032 e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe 95 PID 3032 wrote to memory of 904 3032 e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe 95 PID 3032 wrote to memory of 904 3032 e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe 95 PID 3032 wrote to memory of 904 3032 e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe 95 PID 3032 wrote to memory of 904 3032 e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3904 --field-trial-handle=2260,i,9938964625802268469,1928462186077019554,262144 --variations-seed-version /prefetch:81⤵PID:792
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe.log
Filesize700B
MD5e5352797047ad2c91b83e933b24fbc4f
SHA19bf8ac99b6cbf7ce86ce69524c25e3df75b4d772
SHA256b4643874d42d232c55bfbb75c36da41809d0c9ba4b2a203049aa82950345325c
SHA512dd2fc1966c8b3c9511f14801d1ce8110d6bca276a58216b5eeb0a3cfbb0cc8137ea14efbf790e63736230141da456cbaaa4e5c66f2884d4cfe68f499476fd827