Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/04/2024, 20:59

General

  • Target

    e3452c6f812b8d9f8f97a3ce7b4ad4aa_JaffaCakes118.exe

  • Size

    347KB

  • MD5

    e3452c6f812b8d9f8f97a3ce7b4ad4aa

  • SHA1

    17a69faa00c51b82c337a97c092e58421a03ada9

  • SHA256

    15cea52db77fc6411ed0cd5f248636f190e3ccdd1bb4a3138a95eb60a60ca06f

  • SHA512

    fe0e4a14705aab3ec898ddea6f31531bef5ba3131054488cf2c3f50eed2bd58283a6209cedd3c5797bf6ac9f9a5e5c338c6feb416cd5433293bf14e71867f942

  • SSDEEP

    6144:LQmy92HV36RFEe5r37g7A9cQ6ovMHD3d499O8UYIezrohZwmz:v221KRFEu37kjQ6CMHzm99dIezroha+

Malware Config

Extracted

Family

redline

C2

193.38.55.57:7575

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e3452c6f812b8d9f8f97a3ce7b4ad4aa_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e3452c6f812b8d9f8f97a3ce7b4ad4aa_JaffaCakes118.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1468

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1468-1-0x0000000002760000-0x0000000002860000-memory.dmp

          Filesize

          1024KB

        • memory/1468-2-0x0000000002690000-0x00000000026BF000-memory.dmp

          Filesize

          188KB

        • memory/1468-3-0x0000000004280000-0x00000000042A2000-memory.dmp

          Filesize

          136KB

        • memory/1468-5-0x0000000006C50000-0x00000000071F4000-memory.dmp

          Filesize

          5.6MB

        • memory/1468-6-0x0000000004740000-0x0000000004760000-memory.dmp

          Filesize

          128KB

        • memory/1468-4-0x0000000000400000-0x00000000023C1000-memory.dmp

          Filesize

          31.8MB

        • memory/1468-7-0x00000000047A0000-0x00000000047B0000-memory.dmp

          Filesize

          64KB

        • memory/1468-8-0x00000000047A0000-0x00000000047B0000-memory.dmp

          Filesize

          64KB

        • memory/1468-9-0x00000000047A0000-0x00000000047B0000-memory.dmp

          Filesize

          64KB

        • memory/1468-10-0x0000000007200000-0x0000000007818000-memory.dmp

          Filesize

          6.1MB

        • memory/1468-11-0x0000000074590000-0x0000000074D40000-memory.dmp

          Filesize

          7.7MB

        • memory/1468-12-0x00000000047E0000-0x00000000047F2000-memory.dmp

          Filesize

          72KB

        • memory/1468-13-0x0000000004800000-0x000000000483C000-memory.dmp

          Filesize

          240KB

        • memory/1468-14-0x00000000047A0000-0x00000000047B0000-memory.dmp

          Filesize

          64KB

        • memory/1468-15-0x0000000004860000-0x00000000048AC000-memory.dmp

          Filesize

          304KB

        • memory/1468-16-0x0000000007910000-0x0000000007A1A000-memory.dmp

          Filesize

          1.0MB

        • memory/1468-17-0x0000000000400000-0x00000000023C1000-memory.dmp

          Filesize

          31.8MB

        • memory/1468-18-0x0000000002760000-0x0000000002860000-memory.dmp

          Filesize

          1024KB

        • memory/1468-20-0x00000000047A0000-0x00000000047B0000-memory.dmp

          Filesize

          64KB

        • memory/1468-21-0x00000000047A0000-0x00000000047B0000-memory.dmp

          Filesize

          64KB

        • memory/1468-22-0x00000000047A0000-0x00000000047B0000-memory.dmp

          Filesize

          64KB

        • memory/1468-23-0x0000000074590000-0x0000000074D40000-memory.dmp

          Filesize

          7.7MB

        • memory/1468-24-0x00000000047A0000-0x00000000047B0000-memory.dmp

          Filesize

          64KB