redline | 64af392e3667f1261aeb70ae530c4e47af1ba01834b3c6da9e4eeee89cd206c6

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 13:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe
Size

605KB
MD5

e79c0eb23a7f154e18d9ad0c6ebeda3e
SHA1

e44f16dfe0d63f1d758e60bae3622fca8e834e97
SHA256

64af392e3667f1261aeb70ae530c4e47af1ba01834b3c6da9e4eeee89cd206c6
SHA512

73908bd86c8bd90b10e288554fe1e89444bc38a1fa181b711d43f20fda06736e91ace7ff429488adc0d79f196f9d2b1e7cab11542706a021a9ed0790672dcf2f
SSDEEP

12288:iaalveqz2Uxibc9fKu0Jy5+ihyqqe0RYqojEYIw8VEOksYzvY:0vY

Score

10^/10

redline sectoprat @gulkav infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

@gulkav

vivesemoss.xyz:80

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/4056-3-0x0000000000400000-0x000000000042E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/4056-3-0x0000000000400000-0x000000000042E000-memory.dmp	family_sectoprat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2200 set thread context of 4056	2200	e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe	92

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2200	e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe
Token: SeDebugPrivilege	4056	e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 236	2200	e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe	90
PID 2200 wrote to memory of 236	2200	e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe	90
PID 2200 wrote to memory of 236	2200	e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe	90
PID 2200 wrote to memory of 4056	2200	e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe	92
PID 2200 wrote to memory of 4056	2200	e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe	92
PID 2200 wrote to memory of 4056	2200	e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe	92
PID 2200 wrote to memory of 4056	2200	e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe	92
PID 2200 wrote to memory of 4056	2200	e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe	92
PID 2200 wrote to memory of 4056	2200	e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe	92
PID 2200 wrote to memory of 4056	2200	e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe	92
PID 2200 wrote to memory of 4056	2200	e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe	92

C:\Users\Admin\AppData\Local\Temp\e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Users\Admin\AppData\Local\Temp\e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe
  2⤵
  PID:236
- C:\Users\Admin\AppData\Local\Temp\e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\e79c0eb23a7f154e18d9ad0c6ebeda3e_JaffaCakes118.exe.log

Filesize
847B

MD5
f8ec7f563d06ccddddf6c96b8957e5c8

SHA1
73bdc49dcead32f8c29168645a0f080084132252

SHA256
38ef57aec780edd2c8dab614a85ce87351188fce5896ffebc9f69328df2056ed

SHA512
8830821ac9edb4cdf4d8a3d7bc30433987ae4c158cf81b705654f54aaeba366c5fa3509981aceae21e193dd4483f03b9d449bc0a32545927d3ca94b0f9367684

Download Submit
memory/2200-7-0x0000000075280000-0x0000000075A30000-memory.dmp

Filesize
7.7MB

Download
memory/2200-1-0x0000000075280000-0x0000000075A30000-memory.dmp

Filesize
7.7MB

Download
memory/2200-2-0x0000000005530000-0x0000000005540000-memory.dmp

Filesize
64KB

Download
memory/2200-0-0x0000000000BA0000-0x0000000000C3E000-memory.dmp

Filesize
632KB

Download
memory/4056-8-0x0000000005770000-0x0000000005D88000-memory.dmp

Filesize
6.1MB

Download
memory/4056-3-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4056-6-0x0000000002BB0000-0x0000000002BC0000-memory.dmp

Filesize
64KB

Download
memory/4056-9-0x0000000005210000-0x0000000005222000-memory.dmp

Filesize
72KB

Download
memory/4056-10-0x0000000075280000-0x0000000075A30000-memory.dmp

Filesize
7.7MB

Download
memory/4056-11-0x0000000005270000-0x00000000052AC000-memory.dmp

Filesize
240KB

Download
memory/4056-12-0x00000000052B0000-0x00000000052FC000-memory.dmp

Filesize
304KB

Download
memory/4056-13-0x0000000005500000-0x000000000560A000-memory.dmp

Filesize
1.0MB

Download
memory/4056-14-0x0000000002BB0000-0x0000000002BC0000-memory.dmp

Filesize
64KB

Download
memory/4056-15-0x0000000075280000-0x0000000075A30000-memory.dmp

Filesize
7.7MB

Download