redline | 64af392e3667f1261aeb70ae530c4e47af1ba01834b3c6da9e4eeee89cd206c6

General

Target

e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe
Size

605KB
MD5

e79c0eb23a7f154e18d9ad0c6ebeda3e
SHA1

e44f16dfe0d63f1d758e60bae3622fca8e834e97
SHA256

64af392e3667f1261aeb70ae530c4e47af1ba01834b3c6da9e4eeee89cd206c6
SHA512

73908bd86c8bd90b10e288554fe1e89444bc38a1fa181b711d43f20fda06736e91ace7ff429488adc0d79f196f9d2b1e7cab11542706a021a9ed0790672dcf2f
SSDEEP

12288:iaalveqz2Uxibc9fKu0Jy5+ihyqqe0RYqojEYIw8VEOksYzvY:0vY

Score

10^/10

redline sectoprat @gulkav infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

@gulkav

C2

vivesemoss.xyz:80

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/2152-5-0x0000000000400000-0x000000000042E000-memory.dmp	family_redline
behavioral1/memory/2152-6-0x0000000000400000-0x000000000042E000-memory.dmp	family_redline
behavioral1/memory/2152-9-0x0000000000400000-0x000000000042E000-memory.dmp	family_redline
behavioral1/memory/2152-13-0x0000000000400000-0x000000000042E000-memory.dmp	family_redline
behavioral1/memory/2152-11-0x0000000000400000-0x000000000042E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 5 IoCs

resource	yara_rule
behavioral1/memory/2152-5-0x0000000000400000-0x000000000042E000-memory.dmp	family_sectoprat
behavioral1/memory/2152-6-0x0000000000400000-0x000000000042E000-memory.dmp	family_sectoprat
behavioral1/memory/2152-9-0x0000000000400000-0x000000000042E000-memory.dmp	family_sectoprat
behavioral1/memory/2152-13-0x0000000000400000-0x000000000042E000-memory.dmp	family_sectoprat
behavioral1/memory/2152-11-0x0000000000400000-0x000000000042E000-memory.dmp	family_sectoprat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2076 set thread context of 2152	2076	e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe	31

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2076	e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe
Token: SeDebugPrivilege	2152	e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 1164	2076	e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe	29
PID 2076 wrote to memory of 1164	2076	e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe	29
PID 2076 wrote to memory of 1164	2076	e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe	29
PID 2076 wrote to memory of 1164	2076	e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe	29
PID 2076 wrote to memory of 2060	2076	e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe	30
PID 2076 wrote to memory of 2060	2076	e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe	30
PID 2076 wrote to memory of 2060	2076	e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe	30
PID 2076 wrote to memory of 2060	2076	e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe	30
PID 2076 wrote to memory of 2152	2076	e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe	31
PID 2076 wrote to memory of 2152	2076	e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe	31
PID 2076 wrote to memory of 2152	2076	e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe	31
PID 2076 wrote to memory of 2152	2076	e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe	31
PID 2076 wrote to memory of 2152	2076	e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe	31
PID 2076 wrote to memory of 2152	2076	e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe	31
PID 2076 wrote to memory of 2152	2076	e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe	31
PID 2076 wrote to memory of 2152	2076	e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe	31
PID 2076 wrote to memory of 2152	2076	e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Users\Admin\AppData\Local\Temp\e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe
  2⤵
  PID:1164
- C:\Users\Admin\AppData\Local\Temp\e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe
  2⤵
  PID:2060
- C:\Users\Admin\AppData\Local\Temp\e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2076-0-0x00000000002E0000-0x000000000037E000-memory.dmp

Filesize
632KB

Download
memory/2076-1-0x00000000745C0000-0x0000000074CAE000-memory.dmp

Filesize
6.9MB

Download
memory/2076-2-0x0000000004CA0000-0x0000000004CE0000-memory.dmp

Filesize
256KB

Download
memory/2076-14-0x00000000745C0000-0x0000000074CAE000-memory.dmp

Filesize
6.9MB

Download
memory/2152-6-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2152-5-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2152-4-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2152-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2152-9-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2152-13-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2152-11-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2152-3-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2152-15-0x00000000745C0000-0x0000000074CAE000-memory.dmp

Filesize
6.9MB

Download
memory/2152-16-0x0000000000440000-0x0000000000480000-memory.dmp

Filesize
256KB

Download
memory/2152-17-0x00000000745C0000-0x0000000074CAE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing