Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    06/04/2024, 19:14

General

  • Target

    e31463ec8d305ccc8e713b6f0ab9b026_JaffaCakes118.exe

  • Size

    107KB

  • MD5

    e31463ec8d305ccc8e713b6f0ab9b026

  • SHA1

    1062789bd419fe85c28a81cbe9718bdd00a5708d

  • SHA256

    fc19bd4fe32e57b743d6a00aa3ec3b3107d639bf11a898eff57016ac0627b101

  • SHA512

    c39b9c0488d6d652840d774a52f3bc01f677fb66ddbe9e577617888c516cd7c07a0a36da4baf616b8adb54db294e1388600181921fdd2814f12b0b7896aa8d22

  • SSDEEP

    1536:Ht9pmyZRN/OeYWdOaVezGV4FcnnTbGjbuqgdPnMuyq+dGVkdDjECG6qTaoigi:JZRN/7YaFezGV6cncYPnjyjdGQYPS

Malware Config

Extracted

Family

redline

Botnet

@nicknemer

C2

185.230.143.48:14462

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e31463ec8d305ccc8e713b6f0ab9b026_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e31463ec8d305ccc8e713b6f0ab9b026_JaffaCakes118.exe"
    1⤵
      PID:2380

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/2380-0-0x0000000000C20000-0x0000000000C40000-memory.dmp

            Filesize

            128KB

          • memory/2380-1-0x0000000074360000-0x0000000074A4E000-memory.dmp

            Filesize

            6.9MB

          • memory/2380-2-0x0000000004820000-0x0000000004860000-memory.dmp

            Filesize

            256KB

          • memory/2380-3-0x0000000074360000-0x0000000074A4E000-memory.dmp

            Filesize

            6.9MB

          • memory/2380-4-0x0000000004820000-0x0000000004860000-memory.dmp

            Filesize

            256KB