redline | 5699b954ed556a81666d2a03f7e67342e01f8d3fc0868d12f31f7c8d8fd7b014

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 06:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f2daea1be217ae3816a0fa7075a804e3_JaffaCakes118.exe
Size 2.3MB
Sample240416-gt82aaba39
SHA256 5699b954ed556a81666d2a03f7e67342e01f8d3fc0868d12f31f7c8d8fd7b014
MD5 f2daea1be217ae3816a0fa7075a804e3
SHA1 f1864bd604c30bc94f0f258e625fab4132970d5b
SHA512 07f00886da70dd1d59ffd568f2004cae1b9801286a01bdd0a5a4ea526cb59081935c97eb63d7c47e7edb36861334384fb9d9d89bb2f7e293660116cdd6929787
SSDEEP 49152:a5+hFVOft6aZBYdqBotqimfWpxcilYZ63Mr1v8Gxiz8lVHTIioOFZQ+n:a5aFAgaZB/2tq5fWpxFYZ6ARPxiqZ7n
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline sectoprat @zizyai infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

@zizyai

xetadycami.xyz:80

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/files/0x00070000000233f8-52.dat	family_redline
behavioral2/memory/2024-53-0x0000000000D70000-0x0000000000D8E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

resource	yara_rule
behavioral2/files/0x00070000000233f8-52.dat	family_sectoprat
behavioral2/memory/2024-53-0x0000000000D70000-0x0000000000D8E000-memory.dmp	family_sectoprat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000\Control Panel\International\Geo\Nation	f2daea1be217ae3816a0fa7075a804e3_JaffaCakes118.exe

Executes dropped EXE 7 IoCs

pid	Process
3732	7z.exe
2300	7z.exe
4236	7z.exe
4596	7z.exe
552	7z.exe
4540	7z.exe
2024	@zizyai.exe

Loads dropped DLL 6 IoCs

pid	Process
3732	7z.exe
2300	7z.exe
4236	7z.exe
4596	7z.exe
552	7z.exe
4540	7z.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeRestorePrivilege	3732	7z.exe
Token: 35	3732	7z.exe
Token: SeSecurityPrivilege	3732	7z.exe
Token: SeSecurityPrivilege	3732	7z.exe
Token: SeRestorePrivilege	2300	7z.exe
Token: 35	2300	7z.exe
Token: SeSecurityPrivilege	2300	7z.exe
Token: SeSecurityPrivilege	2300	7z.exe
Token: SeRestorePrivilege	4236	7z.exe
Token: 35	4236	7z.exe
Token: SeSecurityPrivilege	4236	7z.exe
Token: SeSecurityPrivilege	4236	7z.exe
Token: SeRestorePrivilege	4596	7z.exe
Token: 35	4596	7z.exe
Token: SeSecurityPrivilege	4596	7z.exe
Token: SeSecurityPrivilege	4596	7z.exe
Token: SeRestorePrivilege	552	7z.exe
Token: 35	552	7z.exe
Token: SeSecurityPrivilege	552	7z.exe
Token: SeSecurityPrivilege	552	7z.exe
Token: SeRestorePrivilege	4540	7z.exe
Token: 35	4540	7z.exe
Token: SeSecurityPrivilege	4540	7z.exe
Token: SeSecurityPrivilege	4540	7z.exe
Token: SeDebugPrivilege	2024	@zizyai.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 516 wrote to memory of 1268	516	f2daea1be217ae3816a0fa7075a804e3_JaffaCakes118.exe	86
PID 516 wrote to memory of 1268	516	f2daea1be217ae3816a0fa7075a804e3_JaffaCakes118.exe	86
PID 1268 wrote to memory of 4028	1268	cmd.exe	88
PID 1268 wrote to memory of 4028	1268	cmd.exe	88
PID 1268 wrote to memory of 3732	1268	cmd.exe	89
PID 1268 wrote to memory of 3732	1268	cmd.exe	89
PID 1268 wrote to memory of 2300	1268	cmd.exe	90
PID 1268 wrote to memory of 2300	1268	cmd.exe	90
PID 1268 wrote to memory of 4236	1268	cmd.exe	91
PID 1268 wrote to memory of 4236	1268	cmd.exe	91
PID 1268 wrote to memory of 4596	1268	cmd.exe	92
PID 1268 wrote to memory of 4596	1268	cmd.exe	92
PID 1268 wrote to memory of 552	1268	cmd.exe	93
PID 1268 wrote to memory of 552	1268	cmd.exe	93
PID 1268 wrote to memory of 4540	1268	cmd.exe	94
PID 1268 wrote to memory of 4540	1268	cmd.exe	94
PID 1268 wrote to memory of 3992	1268	cmd.exe	95
PID 1268 wrote to memory of 3992	1268	cmd.exe	95
PID 1268 wrote to memory of 2024	1268	cmd.exe	96
PID 1268 wrote to memory of 2024	1268	cmd.exe	96
PID 1268 wrote to memory of 2024	1268	cmd.exe	96

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3992	attrib.exe

C:\Users\Admin\AppData\Local\Temp\f2daea1be217ae3816a0fa7075a804e3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f2daea1be217ae3816a0fa7075a804e3_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\svchost\svchost.cmd" /S"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1268
- - C:\Windows\system32\mode.com
    mode 65,10
    3⤵
    PID:4028
- - C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
    7z.exe e file.zip -p -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:3732
- - C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
    7z.exe e extracted/file_5.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:2300
- - C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
    7z.exe e extracted/file_4.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:4236
- - C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
    7z.exe e extracted/file_3.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:4596
- - C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
    7z.exe e extracted/file_2.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:552
- - C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
    7z.exe e extracted/file_1.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:4540
- - C:\Windows\system32\attrib.exe
    attrib +H "@zizyai.exe"
    3⤵
    - Views/modifies file attributes
    PID:3992
- - C:\Users\Admin\AppData\Local\Temp\svchost\@zizyai.exe
    "@zizyai.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\svchost\7z.dll
Size 1.6MB
SHA256 34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
MD5 72491c7b87a7c2dd350b727444f13bb4
SHA1 1e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA512 583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
SSDEEP 24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zypEqxr2VSlLP:jclmJSVARa86xzW3xRoyqqxrT
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
Size 458KB
SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
MD5 619f7135621b50fd1900ff24aade1524
SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA512 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
SSDEEP 6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7+DHV:r1gL5pRTcAkS/3hzN8qE43fm78V
MD5 SHA1 SHA512 SSDEEP

Submit Download

@zizyai.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost\@zizyai.exe
Size 98KB
SHA256 610303ab50a67dfb789a6301d1dc2b666b1a5915f597d029e4ad6f720255cbec
MD5 8b9e67a27eef86af35880b6c81202203
SHA1 f1c4f316c8a3814e4775ef6370de13cd49d613aa
SHA512 b7e4e46c10c158874010d87824dd212bb8d6d860ffb8bb9b81c82c7f7869c932df27673d3558fe608b78574ee05380ba45e91b8ef5763d05ef16dea7918315cf
SSDEEP 1536:S3LNmoceW9JrxarJPa7JFnGE4mbfexvtuvUy2edQt3DqCxXsESG6ijoigV:SxmocQrw7JcElgtucyHdNSn+
MD5 SHA1 SHA512 SSDEEP

Submit Download

ANTISC~1.DAT

Path C:\Users\Admin\AppData\Local\Temp\svchost\extracted\ANTISC~1.DAT
Size 2.0MB
SHA256 6bdc501f501e5110fade75fe5aa25da12ba8fb5b18b0190e203d62bb60b308e0
MD5 4dac964018b9cfe2575e4483eddbb77c
SHA1 1c08ff8778cb0fc1008405596729dc5bd2f95cf8
SHA512 a571118f78e321cb5e5c9cf461cfacbea3a16e4f02825ec8de0437876d55a2ea8c2cadfce8aadaecd68aee588be12a379b689e1d53cdad7f1697b241a26d6a29
SSDEEP 24576:5yZBPkpRrP9pxC+XvoflcYy36s3vb0EecYy37n92k8GtGAQZ67hR7krC/Cyf0/xg:R9kqGu7okoZscCnf0/Zs97
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_1.zip

Path C:\Users\Admin\AppData\Local\Temp\svchost\extracted\file_1.zip
Size 40KB
SHA256 39ea150f51d07f9e2b337e3b97f25c8dc2b046cead805be63d6bfdfdf53f318b
MD5 1b224bd13835e1ea79e30bbda5b2562f
SHA1 30b4334470efebc47f55cd1b0ed73e43e31b9a37
SHA512 3fc35d26ae4d40ae66f374fb1fc6bfe0bf0e4f8205566d2c7b9f0fa9a27aedef72266230374f53290947a8bd444c3515b9bce8d476363a5246394c21ca1b9b00
SSDEEP 768:eE1DYH3gXI7dUxRXCqTfze9k2ce0x4mh69SRJ7y5wjKaS1nKsxdax:/GXII5mS9cbEsRJ+KjKaS1nKkIx
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_2.zip

Path C:\Users\Admin\AppData\Local\Temp\svchost\extracted\file_2.zip
Size 40KB
SHA256 bb9e0d21f889003d365e0369cf7d897311abcff7d03b859bc4ce885ece6f6bab
MD5 f31e534961b63ca7e2a4523dc60e88ef
SHA1 ff341d720d15a3857c904256f43dad81eda32e5b
SHA512 540d548bd4bddd75283a803d847e7b22e253309e10dc7e5ee76dbdf44f04bdca4663064b9dedd88600d9eb4d05a44243a29befcc96e4bb20055bea15474c7b4e
SSDEEP 768:eE1DYH3gXI5Im50wrIVXejNslbA0dThodfgWqWjLbXujO6DKaS1nKsxdax:/GXII5x0aIlgNCn3h+LojKaS1nKkIx
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_3.zip

Path C:\Users\Admin\AppData\Local\Temp\svchost\extracted\file_3.zip
Size 40KB
SHA256 b6137da4dac40a4bd6d95495cb931e17c5a5098e5a2b89edd6c68edc93918180
MD5 75d3e88ba5a95a24cabf67677b389453
SHA1 c42947c24ffb99bcb486c9a5ee13004cda9b89a7
SHA512 8e991089d76e7ead7a867c36a53458c6901ceb57d27212a390f2849ecbb26bb470041e2c29440e74cd7fba75500e40c61428b9baeafb36e5ab1bcfc2d4e1cd24
SSDEEP 768:wE1DYH3gXI1Im50wrIVXejNslbA0tThodfgWqWjLbXujOTlyNDJXIZf4S2C9:NGXII1x0aIlgNCnHh+Lo+0DVIZwFE
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_4.zip

Path C:\Users\Admin\AppData\Local\Temp\svchost\extracted\file_4.zip
Size 40KB
SHA256 c09a7873ece5add2477e9bbb9688142fa61c77cfd413d34d4d6e9a4eb08f2248
MD5 1c0ce59c69abd9b5887b03b455e57607
SHA1 893d10fc41c37b40c1c9528e3896665935d30d5a
SHA512 75374f47df485bb9687f5108c6e055324db240c540a3adfb6cab4f2807dffeb1c297f21e18595abcb6e4544c7a77b4303aee931c305a9c745fc6a06fa2c60bcd
SSDEEP 768:xE1DYH3gXI1Im50wrIVXejNslbA0tThodfgWqWjLbXujOTlyNDJXIZf4S2Cl:KGXII1x0aIlgNCnHh+Lo+0DVIZwFs
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_5.zip

Path C:\Users\Admin\AppData\Local\Temp\svchost\extracted\file_5.zip
Size 1.5MB
SHA256 e8b57ce531e82fdbbbd598cc3a70ad41fb65181b37eced7a12994118b93d5a6f
MD5 abe51e4151f67266ebdd8f695fbc7f1c
SHA1 035a9a5a1e328c10e3ee249d76ef1fff2a3f33fc
SHA512 67fb41bed210e1f8e92387e95d1f69d75dfc1b79a0df441b9d817cb43aba509c9892070f9a6e5dd00fd5d2fc90671268840fdadc6219257c4405c757a71e9b99
SSDEEP 24576:2bI/7AAb+JQl3Vd02kOC/l5X4/KiROMdWbBkDC6SX39qbwK1ZNKdvLIzn:2ujCK3D0AC/l5mwbBkDWYb1ZN4U7
MD5 SHA1 SHA512 SSDEEP

Submit Download

payload.data

Path C:\Users\Admin\AppData\Local\Temp\svchost\payload.data
Size 1.5MB
SHA256 e9c1e619a20e34eef5f33ad8ae69add834682457291fe947ad583d26966c486e
MD5 36810836110715c71d75e9b40b2bd311
SHA1 ab63a58174e12eb2625ff7afd84ff631cf9d2e88
SHA512 d7ad8692c86c92bffb9091e15714b7e77527d572d88450b0bca48d63c4cdb3ba061ae9156e65536d67f8e70a8e8ea6fa684a19da72e70f639accdf7352585532
SSDEEP 49152:wOYt6aYEYn/8QtCiwWWl/cKkGz6eMrMkVg:igaYESZtC/WWl/KGz6Pvu
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.cmd

Path C:\Users\Admin\AppData\Local\Temp\svchost\svchost.cmd
Size 447B
SHA256 a5c54f407512d21bf9f24e8405a929354570f67fd85bc97eb355b7cc90b2b550
MD5 e5dbad2324da61361204b8a79d5587eb
SHA1 dc9488332228a80fba8b805cfece1afbf59111f4
SHA512 fba9770c4e9b383c1c5e053dd8dbd883262bfcb996fad1876576abc29c46f20605c08c519e07799f7dce9f95c380badd6ad641de3d073241d797e0a04b79833d
MD5 SHA1 SHA512

Submit Download

memory/2024-57-0x00000000057D0000-0x000000000581C000-memory.dmp

Download

memory/2024-56-0x0000000005790000-0x00000000057CC000-memory.dmp

Download

memory/2024-55-0x0000000005730000-0x0000000005742000-memory.dmp

Download

memory/2024-53-0x0000000000D70000-0x0000000000D8E000-memory.dmp

Download

memory/2024-54-0x0000000005C90000-0x00000000062A8000-memory.dmp

Download

memory/2024-58-0x0000000073410000-0x0000000073BC0000-memory.dmp

Download

memory/2024-59-0x0000000005A40000-0x0000000005B4A000-memory.dmp

Download

memory/2024-60-0x00000000058E0000-0x00000000058F0000-memory.dmp

Download

memory/2024-61-0x0000000073410000-0x0000000073BC0000-memory.dmp

Download

memory/2024-62-0x00000000058E0000-0x00000000058F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads