Analysis
-
max time kernel
147s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06/04/2024, 19:09
Static task
static1
Behavioral task
behavioral1
Sample
e311bb2ecd6101e933a4bcfa9f6ebb48_JaffaCakes118.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
e311bb2ecd6101e933a4bcfa9f6ebb48_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
e311bb2ecd6101e933a4bcfa9f6ebb48_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
e311bb2ecd6101e933a4bcfa9f6ebb48
-
SHA1
050d8513370f57b1d95fc63532b8cf7c09b9cf5e
-
SHA256
0c624b0ad0ce62654b7474cf3af80a65d8f51af738a1014300ee7c8b509091a6
-
SHA512
d665bfc39a28a176ea0a5917136db5b79243e42857a0c43b76d86b03b77c34c6b16df2042a82a1d622b86dc785a8e1b37388a142984d7f6c73deeb99ad10a87d
-
SSDEEP
24576:Z4EJ68y1t8G4MW5iLNDSsw2eTya9v6YJd2obm:XkfW5iLNDbGrv5Ecm
Malware Config
Extracted
redline
@barrydillon
185.206.215.216:80
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
SectopRAT payload 2 IoCs
resource yara_rule behavioral2/memory/2352-1-0x0000000000BF0000-0x0000000000FB4000-memory.dmp family_sectoprat behavioral2/memory/2352-3-0x0000000000BF0000-0x0000000000FB4000-memory.dmp family_sectoprat -
Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
pid Process 2352 e311bb2ecd6101e933a4bcfa9f6ebb48_JaffaCakes118.exe 2352 e311bb2ecd6101e933a4bcfa9f6ebb48_JaffaCakes118.exe 2352 e311bb2ecd6101e933a4bcfa9f6ebb48_JaffaCakes118.exe 2352 e311bb2ecd6101e933a4bcfa9f6ebb48_JaffaCakes118.exe 2352 e311bb2ecd6101e933a4bcfa9f6ebb48_JaffaCakes118.exe 2352 e311bb2ecd6101e933a4bcfa9f6ebb48_JaffaCakes118.exe 2352 e311bb2ecd6101e933a4bcfa9f6ebb48_JaffaCakes118.exe 2352 e311bb2ecd6101e933a4bcfa9f6ebb48_JaffaCakes118.exe 2352 e311bb2ecd6101e933a4bcfa9f6ebb48_JaffaCakes118.exe 2352 e311bb2ecd6101e933a4bcfa9f6ebb48_JaffaCakes118.exe 2352 e311bb2ecd6101e933a4bcfa9f6ebb48_JaffaCakes118.exe 2352 e311bb2ecd6101e933a4bcfa9f6ebb48_JaffaCakes118.exe 2352 e311bb2ecd6101e933a4bcfa9f6ebb48_JaffaCakes118.exe 2352 e311bb2ecd6101e933a4bcfa9f6ebb48_JaffaCakes118.exe 2352 e311bb2ecd6101e933a4bcfa9f6ebb48_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2352 e311bb2ecd6101e933a4bcfa9f6ebb48_JaffaCakes118.exe