redline | 9365864ba2cd9a14dbc860dc8b59caa508b3fb169a34a074e7863aa8c876bdd9

General

Target

f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe
Size

191KB
MD5

f1d80d08c2254de011013a6b0bb40450
SHA1

93c1cf0c0ccf112b645a406c467c55d6c7c7257b
SHA256

9365864ba2cd9a14dbc860dc8b59caa508b3fb169a34a074e7863aa8c876bdd9
SHA512

e470b967ca7d0e34d3757ced7950f7c8011d632040a5df16933f6c02c61b975a56ba732901d895ee989380c45e56ada9e46ef63265aed1a8cce74ebc1158e676
SSDEEP

3072:GigNpNcLgyZkiRAZPb7eUKmSvizIVKh7jAdGvXCKAbPUO8xve1KjkcDIVTFV2Mu:GtNzIxDRAZP/eUKmSvizIV27vXCKpxvl

Score

10^/10

redline sectoprat 723 infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

723

C2

qumaranero.xyz:80

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1716-4-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1716-7-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1716-9-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1716-4-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/1716-7-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/1716-9-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

Suspicious use of SetThreadContext 1 IoCs

Processes:

f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe

description	pid	process	target process
PID 2356 set thread context of 1716	2356	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exef1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2356	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe
Token: SeDebugPrivilege	1716	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe

description	pid	process	target process
PID 2356 wrote to memory of 1716	2356	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe
PID 2356 wrote to memory of 1716	2356	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe
PID 2356 wrote to memory of 1716	2356	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe
PID 2356 wrote to memory of 1716	2356	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe
PID 2356 wrote to memory of 1716	2356	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe
PID 2356 wrote to memory of 1716	2356	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe
PID 2356 wrote to memory of 1716	2356	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe
PID 2356 wrote to memory of 1716	2356	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe
PID 2356 wrote to memory of 1716	2356	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe
PID 2356 wrote to memory of 1716	2356	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe
PID 2356 wrote to memory of 1716	2356	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe
PID 2356 wrote to memory of 1716	2356	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2356

C:\Users\Admin\AppData\Local\Temp\f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1716-4-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1716-7-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1716-9-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1716-10-0x0000000074830000-0x0000000074F1E000-memory.dmp

Filesize
6.9MB

Download
memory/1716-11-0x0000000004B90000-0x0000000004BD0000-memory.dmp

Filesize
256KB

Download
memory/1716-12-0x0000000074830000-0x0000000074F1E000-memory.dmp

Filesize
6.9MB

Download
memory/1716-13-0x0000000004B90000-0x0000000004BD0000-memory.dmp

Filesize
256KB

Download
memory/2356-0-0x0000000000D20000-0x0000000000D54000-memory.dmp

Filesize
208KB

Download
memory/2356-1-0x00000000748B0000-0x0000000074F9E000-memory.dmp

Filesize
6.9MB

Download
memory/2356-2-0x0000000004920000-0x0000000004960000-memory.dmp

Filesize
256KB

Download
memory/2356-3-0x0000000000470000-0x0000000000484000-memory.dmp

Filesize
80KB

Download
memory/2356-6-0x00000000748B0000-0x0000000074F9E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads