redline | b8e902d0a3a533b5a9f495f58c69692ae79917fbf9fa7829a9c52d4012e7a060

Analysis

max time kernel
138s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-04-2024 15:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe
Size

606KB
MD5

e2d959b36754b37727ef0c54b11ef3cf
SHA1

fffc93eec7deeda7d17ab729f89d4c5e01d781cf
SHA256

b8e902d0a3a533b5a9f495f58c69692ae79917fbf9fa7829a9c52d4012e7a060
SHA512

9a1b180bdba8fa4d0e4c8e9e3417653278d531811ac4cfe89ad988690e006bbb531824d4c1b5c94b07b1f7f98fa47d6b8a5c64a1be2818084e60e25c2b45c807
SSDEEP

12288:Wk0ryoZx5eA1GoeW6kZ5mW/tpy1UV5bO/Zj+t:LqB13eW

Score

10^/10

redline sectoprat nanani infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

NANani

87.251.71.14:89

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/904-6-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/904-6-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

Suspicious use of SetThreadContext 1 IoCs

Processes:

e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe

description	pid	process	target process
PID 3032 set thread context of 904	3032	e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe	e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 904 e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	904	e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe

description	pid	process	target process
PID 3032 wrote to memory of 904	3032	e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe	e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe
PID 3032 wrote to memory of 904	3032	e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe	e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe
PID 3032 wrote to memory of 904	3032	e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe	e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe
PID 3032 wrote to memory of 904	3032	e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe	e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe
PID 3032 wrote to memory of 904	3032	e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe	e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe
PID 3032 wrote to memory of 904	3032	e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe	e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe
PID 3032 wrote to memory of 904	3032	e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe	e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe
PID 3032 wrote to memory of 904	3032	e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe	e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3032

C:\Users\Admin\AppData\Local\Temp\e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3904 --field-trial-handle=2260,i,9938964625802268469,1928462186077019554,262144 --variations-seed-version /prefetch:8
1⤵
PID:792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\e2d959b36754b37727ef0c54b11ef3cf_JaffaCakes118.exe.log
Filesize
700B

MD5
e5352797047ad2c91b83e933b24fbc4f

SHA1
9bf8ac99b6cbf7ce86ce69524c25e3df75b4d772

SHA256
b4643874d42d232c55bfbb75c36da41809d0c9ba4b2a203049aa82950345325c

SHA512
dd2fc1966c8b3c9511f14801d1ce8110d6bca276a58216b5eeb0a3cfbb0cc8137ea14efbf790e63736230141da456cbaaa4e5c66f2884d4cfe68f499476fd827

Download Submit
memory/904-9-0x0000000005DB0000-0x00000000063C8000-memory.dmp

Filesize
6.1MB

Download
memory/904-16-0x0000000074EB0000-0x0000000075660000-memory.dmp

Filesize
7.7MB

Download
memory/904-15-0x0000000005A90000-0x0000000005B9A000-memory.dmp

Filesize
1.0MB

Download
memory/904-14-0x0000000005830000-0x000000000587C000-memory.dmp

Filesize
304KB

Download
memory/904-13-0x00000000057F0000-0x000000000582C000-memory.dmp

Filesize
240KB

Download
memory/904-12-0x0000000005790000-0x00000000057A2000-memory.dmp

Filesize
72KB

Download
memory/904-6-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/904-11-0x0000000074EB0000-0x0000000075660000-memory.dmp

Filesize
7.7MB

Download
memory/3032-4-0x0000000004CC0000-0x0000000004CDE000-memory.dmp

Filesize
120KB

Download
memory/3032-10-0x0000000074EB0000-0x0000000075660000-memory.dmp

Filesize
7.7MB

Download
memory/3032-5-0x00000000054B0000-0x0000000005A54000-memory.dmp

Filesize
5.6MB

Download
memory/3032-0-0x0000000074EB0000-0x0000000075660000-memory.dmp

Filesize
7.7MB

Download
memory/3032-3-0x0000000004EF0000-0x0000000004F00000-memory.dmp

Filesize
64KB

Download
memory/3032-2-0x0000000004D20000-0x0000000004D96000-memory.dmp

Filesize
472KB

Download
memory/3032-1-0x0000000000340000-0x00000000003DE000-memory.dmp

Filesize
632KB

Download