redline | 9365864ba2cd9a14dbc860dc8b59caa508b3fb169a34a074e7863aa8c876bdd9

General

Target

f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe
Size

191KB
MD5

f1d80d08c2254de011013a6b0bb40450
SHA1

93c1cf0c0ccf112b645a406c467c55d6c7c7257b
SHA256

9365864ba2cd9a14dbc860dc8b59caa508b3fb169a34a074e7863aa8c876bdd9
SHA512

e470b967ca7d0e34d3757ced7950f7c8011d632040a5df16933f6c02c61b975a56ba732901d895ee989380c45e56ada9e46ef63265aed1a8cce74ebc1158e676
SSDEEP

3072:GigNpNcLgyZkiRAZPb7eUKmSvizIVKh7jAdGvXCKAbPUO8xve1KjkcDIVTFV2Mu:GtNzIxDRAZP/eUKmSvizIV27vXCKpxvl

Score

10^/10

redline sectoprat 723 infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

723

C2

qumaranero.xyz:80

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2392-6-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2392-6-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

Suspicious use of SetThreadContext 1 IoCs

Processes:

f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe

description	pid	process	target process
PID 2524 set thread context of 2392	2524	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exef1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2524	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe
Token: SeDebugPrivilege	2392	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe

description	pid	process	target process
PID 2524 wrote to memory of 1508	2524	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe
PID 2524 wrote to memory of 1508	2524	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe
PID 2524 wrote to memory of 1508	2524	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe
PID 2524 wrote to memory of 2392	2524	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe
PID 2524 wrote to memory of 2392	2524	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe
PID 2524 wrote to memory of 2392	2524	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe
PID 2524 wrote to memory of 2392	2524	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe
PID 2524 wrote to memory of 2392	2524	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe
PID 2524 wrote to memory of 2392	2524	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe
PID 2524 wrote to memory of 2392	2524	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe
PID 2524 wrote to memory of 2392	2524	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe	f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2524

C:\Users\Admin\AppData\Local\Temp\f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe
2⤵
PID:1508

C:\Users\Admin\AppData\Local\Temp\f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\f1d80d08c2254de011013a6b0bb40450_JaffaCakes118.exe.log
Filesize
605B

MD5
3654bd2c6957761095206ffdf92b0cb9

SHA1
6f10f7b5867877de7629afcff644c265e79b4ad3

SHA256
c2a4be94cf4ed33d698d9838f4ffb47047da796e733ec11562463a1621212ab4

SHA512
e2a81248cca7732ce098088d5237897493fd3629e28d66bc13e5f9191f72cd52893f4a53905906af12d5c6de475738b6c7f6b718a32869e9ee0deb3a54672f79

Download Submit
memory/2392-13-0x00000000053C0000-0x00000000053FC000-memory.dmp

Filesize
240KB

Download
memory/2392-15-0x0000000005400000-0x000000000544C000-memory.dmp

Filesize
304KB

Download
memory/2392-11-0x0000000075240000-0x00000000759F0000-memory.dmp

Filesize
7.7MB

Download
memory/2392-18-0x0000000005500000-0x0000000005510000-memory.dmp

Filesize
64KB

Download
memory/2392-12-0x0000000005360000-0x0000000005372000-memory.dmp

Filesize
72KB

Download
memory/2392-6-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2392-17-0x0000000075240000-0x00000000759F0000-memory.dmp

Filesize
7.7MB

Download
memory/2392-16-0x0000000005670000-0x000000000577A000-memory.dmp

Filesize
1.0MB

Download
memory/2392-14-0x0000000005500000-0x0000000005510000-memory.dmp

Filesize
64KB

Download
memory/2392-10-0x0000000005900000-0x0000000005F18000-memory.dmp

Filesize
6.1MB

Download
memory/2524-5-0x0000000005590000-0x00000000055AE000-memory.dmp

Filesize
120KB

Download
memory/2524-1-0x0000000075240000-0x00000000759F0000-memory.dmp

Filesize
7.7MB

Download
memory/2524-3-0x00000000030C0000-0x00000000030D4000-memory.dmp

Filesize
80KB

Download
memory/2524-2-0x00000000056C0000-0x00000000056D0000-memory.dmp

Filesize
64KB

Download
memory/2524-9-0x0000000075240000-0x00000000759F0000-memory.dmp

Filesize
7.7MB

Download
memory/2524-0-0x0000000000D00000-0x0000000000D34000-memory.dmp

Filesize
208KB

Download
memory/2524-4-0x00000000055F0000-0x0000000005666000-memory.dmp

Filesize
472KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads