Analysis

  • max time kernel
    117s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    03/05/2024, 14:55

General

  • Target

    10c88faf59369b1de89571283669aaae_JaffaCakes118.exe

  • Size

    1024KB

  • MD5

    10c88faf59369b1de89571283669aaae

  • SHA1

    a0dfa4ae8397fd67fe96f1bcbce62b0f79d57e71

  • SHA256

    7ddb2b796907b6d56dbaffd41eec9c48dafc9bb24b75d123ed5af408f8db8062

  • SHA512

    f98e146372f6db1a6914f9f92c2b37eb6fd907b8173f2d8ea23d65e0bc039db7da39c5cb023fff6291666e7e102bb22c503b33ea0e90564f807bab4fd55c0e7b

  • SSDEEP

    24576:gk70Trckyima96k6361eU67QinCzrtoXwwh:gkQTAsIk6q15aC9oXb

Malware Config

Extracted

Family

redline

Botnet

122

C2

156.238.184.172:80

Signatures

  • Detect ZGRat V1 2 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Suspicious use of SetThreadContext 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\10c88faf59369b1de89571283669aaae_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\10c88faf59369b1de89571283669aaae_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2032
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1164
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /C taskkill /F /PID 1164 && choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2596
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /PID 1164
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2576
        • C:\Windows\SysWOW64\choice.exe
          choice /C Y /N /D Y /T 3
          4⤵
            PID:2556

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1164-14-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

          • memory/1164-9-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

          • memory/1164-18-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

          • memory/1164-7-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

          • memory/1164-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

            Filesize

            4KB

          • memory/1164-11-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

          • memory/1164-16-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

          • memory/1164-6-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

          • memory/2032-1-0x0000000004A60000-0x0000000004B24000-memory.dmp

            Filesize

            784KB

          • memory/2032-0-0x00000000745CE000-0x00000000745CF000-memory.dmp

            Filesize

            4KB

          • memory/2032-4-0x00000000048E0000-0x00000000049A2000-memory.dmp

            Filesize

            776KB

          • memory/2032-3-0x00000000745C0000-0x0000000074CAE000-memory.dmp

            Filesize

            6.9MB

          • memory/2032-2-0x00000000745C0000-0x0000000074CAE000-memory.dmp

            Filesize

            6.9MB

          • memory/2032-19-0x00000000745C0000-0x0000000074CAE000-memory.dmp

            Filesize

            6.9MB