Analysis

  • max time kernel
    144s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    06/04/2024, 20:59

General

  • Target

    e3452c6f812b8d9f8f97a3ce7b4ad4aa_JaffaCakes118.exe

  • Size

    347KB

  • MD5

    e3452c6f812b8d9f8f97a3ce7b4ad4aa

  • SHA1

    17a69faa00c51b82c337a97c092e58421a03ada9

  • SHA256

    15cea52db77fc6411ed0cd5f248636f190e3ccdd1bb4a3138a95eb60a60ca06f

  • SHA512

    fe0e4a14705aab3ec898ddea6f31531bef5ba3131054488cf2c3f50eed2bd58283a6209cedd3c5797bf6ac9f9a5e5c338c6feb416cd5433293bf14e71867f942

  • SSDEEP

    6144:LQmy92HV36RFEe5r37g7A9cQ6ovMHD3d499O8UYIezrohZwmz:v221KRFEu37kjQ6CMHzm99dIezroha+

Malware Config

Extracted

Family

redline

C2

193.38.55.57:7575

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 4 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e3452c6f812b8d9f8f97a3ce7b4ad4aa_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e3452c6f812b8d9f8f97a3ce7b4ad4aa_JaffaCakes118.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2952

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2952-1-0x0000000000290000-0x0000000000390000-memory.dmp

          Filesize

          1024KB

        • memory/2952-2-0x0000000000260000-0x000000000028F000-memory.dmp

          Filesize

          188KB

        • memory/2952-4-0x0000000003C90000-0x0000000003CB2000-memory.dmp

          Filesize

          136KB

        • memory/2952-3-0x0000000000400000-0x00000000023C1000-memory.dmp

          Filesize

          31.8MB

        • memory/2952-5-0x00000000067B0000-0x00000000067F0000-memory.dmp

          Filesize

          256KB

        • memory/2952-6-0x00000000067B0000-0x00000000067F0000-memory.dmp

          Filesize

          256KB

        • memory/2952-7-0x0000000073E50000-0x000000007453E000-memory.dmp

          Filesize

          6.9MB

        • memory/2952-8-0x0000000004010000-0x0000000004030000-memory.dmp

          Filesize

          128KB

        • memory/2952-9-0x00000000067B0000-0x00000000067F0000-memory.dmp

          Filesize

          256KB

        • memory/2952-11-0x0000000000290000-0x0000000000390000-memory.dmp

          Filesize

          1024KB

        • memory/2952-12-0x00000000067B0000-0x00000000067F0000-memory.dmp

          Filesize

          256KB

        • memory/2952-13-0x0000000073E50000-0x000000007453E000-memory.dmp

          Filesize

          6.9MB

        • memory/2952-15-0x00000000067B0000-0x00000000067F0000-memory.dmp

          Filesize

          256KB

        • memory/2952-16-0x00000000067B0000-0x00000000067F0000-memory.dmp

          Filesize

          256KB