redline | cecc0d25318bfe6b3f927d8ad5304c84e98c29142f243794619e6cb044cd4bb3

Analysis

max time kernel
143s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-04-2024 16:50

Target

ede690e47cd28b61c55b2a2a59dce3c9_JaffaCakes118.exe
Size

290KB
MD5

ede690e47cd28b61c55b2a2a59dce3c9
SHA1

2531f53b49e637c08f60b286f1b62359e2374c48
SHA256

cecc0d25318bfe6b3f927d8ad5304c84e98c29142f243794619e6cb044cd4bb3
SHA512

5984f7ba8e57c9f9188337a414c41be1d5672b1667f54bb9176274e51d4d3d462636840aa61d6d9d724bb0e94c81e0c3f02939eaff00c8fde85983cecae1da10
SSDEEP

6144:WL7DHlZB6gGLSn5wADB4llzci1mh1llhA:WnDHlZXGLSn5wASrNQFl

Score

10^/10

Family

redline

Botnet

SewPalpadin

185.215.113.114:8887

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1896-4-0x00000000047C0000-0x00000000047E0000-memory.dmp	family_redline
behavioral1/memory/1896-8-0x0000000004830000-0x000000000484E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1896-4-0x00000000047C0000-0x00000000047E0000-memory.dmp	family_sectoprat
behavioral1/memory/1896-8-0x0000000004830000-0x000000000484E000-memory.dmp	family_sectoprat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ede690e47cd28b61c55b2a2a59dce3c9_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 1896 ede690e47cd28b61c55b2a2a59dce3c9_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	1896	ede690e47cd28b61c55b2a2a59dce3c9_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ede690e47cd28b61c55b2a2a59dce3c9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ede690e47cd28b61c55b2a2a59dce3c9_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1896

memory/1896-1-0x0000000002D60000-0x0000000002E60000-memory.dmp

Filesize
1024KB

Download
memory/1896-2-0x00000000002B0000-0x00000000002DF000-memory.dmp

Filesize
188KB

Download
memory/1896-3-0x0000000000400000-0x0000000002CD6000-memory.dmp

Filesize
40.8MB

Download
memory/1896-4-0x00000000047C0000-0x00000000047E0000-memory.dmp

Filesize
128KB

Download
memory/1896-5-0x0000000074710000-0x0000000074DFE000-memory.dmp

Filesize
6.9MB

Download
memory/1896-6-0x00000000071C0000-0x0000000007200000-memory.dmp

Filesize
256KB

Download
memory/1896-7-0x00000000071C0000-0x0000000007200000-memory.dmp

Filesize
256KB

Download
memory/1896-8-0x0000000004830000-0x000000000484E000-memory.dmp

Filesize
120KB

Download
memory/1896-9-0x00000000071C0000-0x0000000007200000-memory.dmp

Filesize
256KB

Download
memory/1896-11-0x0000000002D60000-0x0000000002E60000-memory.dmp

Filesize
1024KB

Download
memory/1896-12-0x0000000074710000-0x0000000074DFE000-memory.dmp

Filesize
6.9MB

Download
memory/1896-14-0x00000000071C0000-0x0000000007200000-memory.dmp

Filesize
256KB

Download
memory/1896-15-0x00000000071C0000-0x0000000007200000-memory.dmp

Filesize
256KB

Download