Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
19-04-2024 11:54
General
-
Target
fa3d40ce6752360f82f85789de9206da_JaffaCakes118.exe
-
Size
19.3MB
-
MD5
fa3d40ce6752360f82f85789de9206da
-
SHA1
b2257a28bd6c5fc2330c43911cb3b09fc7a3f793
-
SHA256
290fbd80875f828748b26dd45ea64d3a289cb94f5bda9f6998a5f4e054af4d4a
-
SHA512
0e1be7b19409625f4dd821aaaeec8b0105ca6c5db34ccb2d0dbeec56916a61c12f78164ba09fea0f865c64d0c13dbf933c22175a4ccaceec042ff3f38a2075b9
-
SSDEEP
196608:ItKgK+WQiP0b9HVd2THcW/VYDzBAdLGMyO2FUAfvHoqToihJ:1gKlcb5Vd2THcWt4wLbyOifvHr
Malware Config
Extracted
redline
@treeline300
45.67.228.152:54641
Signatures
-
Babadeda
Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.
-
Babadeda Crypter 3 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa3d40ce6752360f82f85789de9206da_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fa3d40ce6752360f82f85789de9206da_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Delimon Software\Delimon IO Assembly\ioassembly.exe"C:\Users\Admin\AppData\Roaming\Delimon Software\Delimon IO Assembly\ioassembly.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD59325aee138a4d9a15d651920fb403ffc
SHA119eb57cd989571fa8cd426cbd680430c0e006408
SHA2569c8346c7f288e63933ebda42cbb874f76067c48198b01adfb63bccfa11970c35
SHA512d3c0ccf217346e44436ac4f9db3e71b6d2eb152930005f019db5b58dcce923d94007e77fa5b938e182073c2e55163e886853b00e3fc22f135d70854120a218a8
-
Filesize
56KB
MD5520077fd6d03c64c735258d4d87921d8
SHA11b8d82d7da2d85527ce91e72f179fb8a418d47de
SHA2566faf5a4f8a729dbdc4082a7f33ffde3e72ef34acbf0875932b3e4427bfd9b598
SHA5128ccd614aaf7cee74a0ed8b34267db004f240ed51d41dd80caeef12fe29a785d4e109b2526acf4c04ff30edc025c1e4afd7e9e11b32ca08ecc3ced7435514d4de
-
Filesize
386KB
MD5a18ed82a8dddccca1113a2cb992c1617
SHA1b49c499776a8fcce659e307dbc018de78bba494e
SHA256f3a71f6466be37fcb5066258f8b25ee7db68aebd6c8b9e06d83d2c882851781c
SHA5124ec5b1bbaf6a16f038bba46eae5558132947576178d7ee861f831887001def116467ccdac9b4b7f196925f2a0f05e545abc95e465a85cac2a86a12cd7c4aeca6
-
Filesize
10.5MB
MD5ecf7cced163166a2ca2028f87c09adfb
SHA154ac3d3ff99707a9220c72a1e30643d0e7dfe5ed
SHA256518105a21064101544174005643c12b24404da142482e074453c27dc8d857fe6
SHA51202bcf0ef6c7cab94f8090d55d5d7bca400ccf5693dc0f9c8837c77b56df25f75fa42676051d9a0016020fa78a898e2b63bc7267cc4435bc562af90dec4616e64
-
Filesize
3.9MB
MD591fb31637b57a44e2254dd83359334bd
SHA140adc1a5802146e2267a743f1c9ed39aafaa80a2
SHA256dba6d23b14a2e6c2b80a27672f4902efbf70f601a7f2c55e2ced6ead0131eb3e
SHA51295ed67b17935f9cee2ce15afdf6f094e4a522f0a5fa5b90f04adb88fc33a521a1ee8206b7249b8b3c0717eec56e36efcff404e6bc44449983fa0d20cf3eeab7c
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
6.1MB
-
Filesize
48.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
120KB
-
Filesize
240KB
-
Filesize
7.7MB
-
Filesize
304KB
-
Filesize
1.0MB
-
Filesize
48.0MB
-
Filesize
7.7MB
-
Filesize
204KB