redline | e1130b856161680a39ebf5d759bd25663b598e69b6ef68721933958ac644a496

General

Target

e307bef30d37b965e01405176a9e30fe_JaffaCakes118.exe
Size

372KB
MD5

e307bef30d37b965e01405176a9e30fe
SHA1

67262332808dfa5e9fa2b5cb405a85a6990ef5f7
SHA256

e1130b856161680a39ebf5d759bd25663b598e69b6ef68721933958ac644a496
SHA512

dc8c9ae0795325c9fc45af96a2cc1f800779ae45ea1674f1c1147f2cf1209804686662074a938480bc159f890b71ae8531151448dfed537e5857a64ad9d72af6
SSDEEP

6144:QhdM4Ry8thtYa98ETRUg3Qo1mPAsHZvLl8Z1pvu3OeC7CaokduRXEf:UdM4E8htYa98ETRUg3Qo1mPAsHZvLl87

Score

10^/10

redline sectoprat sel21 infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

sel21

C2

salkefard.xyz:80

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2228-5-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2228-6-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2228-9-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2228-11-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2228-14-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2228-5-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2228-6-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2228-9-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2228-11-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2228-14-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

Suspicious use of SetThreadContext 1 IoCs

Processes:

e307bef30d37b965e01405176a9e30fe_JaffaCakes118.exe

description	pid	process	target process
PID 1512 set thread context of 2228	1512	e307bef30d37b965e01405176a9e30fe_JaffaCakes118.exe	e307bef30d37b965e01405176a9e30fe_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

e307bef30d37b965e01405176a9e30fe_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2228 e307bef30d37b965e01405176a9e30fe_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2228	e307bef30d37b965e01405176a9e30fe_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

e307bef30d37b965e01405176a9e30fe_JaffaCakes118.exe

description	pid	process	target process
PID 1512 wrote to memory of 2000	1512	e307bef30d37b965e01405176a9e30fe_JaffaCakes118.exe	e307bef30d37b965e01405176a9e30fe_JaffaCakes118.exe
PID 1512 wrote to memory of 2000	1512	e307bef30d37b965e01405176a9e30fe_JaffaCakes118.exe	e307bef30d37b965e01405176a9e30fe_JaffaCakes118.exe
PID 1512 wrote to memory of 2000	1512	e307bef30d37b965e01405176a9e30fe_JaffaCakes118.exe	e307bef30d37b965e01405176a9e30fe_JaffaCakes118.exe
PID 1512 wrote to memory of 2000	1512	e307bef30d37b965e01405176a9e30fe_JaffaCakes118.exe	e307bef30d37b965e01405176a9e30fe_JaffaCakes118.exe
PID 1512 wrote to memory of 2228	1512	e307bef30d37b965e01405176a9e30fe_JaffaCakes118.exe	e307bef30d37b965e01405176a9e30fe_JaffaCakes118.exe
PID 1512 wrote to memory of 2228	1512	e307bef30d37b965e01405176a9e30fe_JaffaCakes118.exe	e307bef30d37b965e01405176a9e30fe_JaffaCakes118.exe
PID 1512 wrote to memory of 2228	1512	e307bef30d37b965e01405176a9e30fe_JaffaCakes118.exe	e307bef30d37b965e01405176a9e30fe_JaffaCakes118.exe
PID 1512 wrote to memory of 2228	1512	e307bef30d37b965e01405176a9e30fe_JaffaCakes118.exe	e307bef30d37b965e01405176a9e30fe_JaffaCakes118.exe
PID 1512 wrote to memory of 2228	1512	e307bef30d37b965e01405176a9e30fe_JaffaCakes118.exe	e307bef30d37b965e01405176a9e30fe_JaffaCakes118.exe
PID 1512 wrote to memory of 2228	1512	e307bef30d37b965e01405176a9e30fe_JaffaCakes118.exe	e307bef30d37b965e01405176a9e30fe_JaffaCakes118.exe
PID 1512 wrote to memory of 2228	1512	e307bef30d37b965e01405176a9e30fe_JaffaCakes118.exe	e307bef30d37b965e01405176a9e30fe_JaffaCakes118.exe
PID 1512 wrote to memory of 2228	1512	e307bef30d37b965e01405176a9e30fe_JaffaCakes118.exe	e307bef30d37b965e01405176a9e30fe_JaffaCakes118.exe
PID 1512 wrote to memory of 2228	1512	e307bef30d37b965e01405176a9e30fe_JaffaCakes118.exe	e307bef30d37b965e01405176a9e30fe_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\e307bef30d37b965e01405176a9e30fe_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e307bef30d37b965e01405176a9e30fe_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1512

C:\Users\Admin\AppData\Local\Temp\e307bef30d37b965e01405176a9e30fe_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\e307bef30d37b965e01405176a9e30fe_JaffaCakes118.exe
2⤵
PID:2000

C:\Users\Admin\AppData\Local\Temp\e307bef30d37b965e01405176a9e30fe_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\e307bef30d37b965e01405176a9e30fe_JaffaCakes118.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1512-0-0x0000000000DE0000-0x0000000000E44000-memory.dmp

Filesize
400KB

Download
memory/1512-1-0x00000000749D0000-0x00000000750BE000-memory.dmp

Filesize
6.9MB

Download
memory/1512-2-0x0000000004AD0000-0x0000000004B10000-memory.dmp

Filesize
256KB

Download
memory/1512-13-0x00000000749D0000-0x00000000750BE000-memory.dmp

Filesize
6.9MB

Download
memory/2228-6-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2228-5-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2228-4-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2228-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2228-9-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2228-11-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2228-3-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2228-14-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2228-15-0x0000000074950000-0x000000007503E000-memory.dmp

Filesize
6.9MB

Download
memory/2228-16-0x0000000004EF0000-0x0000000004F30000-memory.dmp

Filesize
256KB

Download
memory/2228-17-0x0000000074950000-0x000000007503E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads