Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/04/2024, 19:14

General

  • Target

    e31463ec8d305ccc8e713b6f0ab9b026_JaffaCakes118.exe

  • Size

    107KB

  • MD5

    e31463ec8d305ccc8e713b6f0ab9b026

  • SHA1

    1062789bd419fe85c28a81cbe9718bdd00a5708d

  • SHA256

    fc19bd4fe32e57b743d6a00aa3ec3b3107d639bf11a898eff57016ac0627b101

  • SHA512

    c39b9c0488d6d652840d774a52f3bc01f677fb66ddbe9e577617888c516cd7c07a0a36da4baf616b8adb54db294e1388600181921fdd2814f12b0b7896aa8d22

  • SSDEEP

    1536:Ht9pmyZRN/OeYWdOaVezGV4FcnnTbGjbuqgdPnMuyq+dGVkdDjECG6qTaoigi:JZRN/7YaFezGV6cncYPnjyjdGQYPS

Malware Config

Extracted

Family

redline

Botnet

@nicknemer

C2

185.230.143.48:14462

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e31463ec8d305ccc8e713b6f0ab9b026_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e31463ec8d305ccc8e713b6f0ab9b026_JaffaCakes118.exe"
    1⤵
      PID:4860

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/4860-0-0x0000000000A70000-0x0000000000A90000-memory.dmp

            Filesize

            128KB

          • memory/4860-1-0x0000000074F00000-0x00000000756B0000-memory.dmp

            Filesize

            7.7MB

          • memory/4860-2-0x0000000005A00000-0x0000000006018000-memory.dmp

            Filesize

            6.1MB

          • memory/4860-3-0x0000000005400000-0x0000000005412000-memory.dmp

            Filesize

            72KB

          • memory/4860-4-0x0000000005530000-0x000000000563A000-memory.dmp

            Filesize

            1.0MB

          • memory/4860-5-0x0000000005810000-0x0000000005820000-memory.dmp

            Filesize

            64KB

          • memory/4860-6-0x0000000005460000-0x000000000549C000-memory.dmp

            Filesize

            240KB

          • memory/4860-7-0x00000000054A0000-0x00000000054EC000-memory.dmp

            Filesize

            304KB

          • memory/4860-8-0x0000000074F00000-0x00000000756B0000-memory.dmp

            Filesize

            7.7MB

          • memory/4860-9-0x0000000005810000-0x0000000005820000-memory.dmp

            Filesize

            64KB