Overview

overview

10

Static

static

1

203dcfe837...18.exe

windows7-x64

10

203dcfe837...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    02-07-2024 17:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    203dcfe837a8a2273d26b5d2c8500660_JaffaCakes118.exe

  • Size

    331KB

  • MD5

    203dcfe837a8a2273d26b5d2c8500660

  • SHA1

    757d3d7232f339b746281b2d328e55a5bcd2a971

  • SHA256

    7e034e6e6aade8d171cef476c5068d10c385bd84858d8073850ad7163bc25f23

  • SHA512

    bd03bc3b5bf259a2d1df138d93f45d2e2c37ee05e1e3205bfbf5684d39f1b6fa521bef61503046f04610e0a302219f279a11250dcc1179aa808608ca6c6515f0

  • SSDEEP

    6144:gUBWwBum0a7QXqCCgHBK7khCZZQtf9JMHHK8iM55f5GHagKlUJFGUvA75GL:Qzm0La/gHBHhCCuHliMPfWMlsq8L

Score
10/10
redlinesectoprat@keynejkeeinfostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

@keynejkee

C2

164.132.72.186:18717

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 4 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat
  • SectopRAT payload 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\203dcfe837a8a2273d26b5d2c8500660_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\203dcfe837a8a2273d26b5d2c8500660_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1300
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:3020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1300-2-0x00000000002B0000-0x00000000002B1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1300-3-0x0000000078A30000-0x0000000078A7F2E0-memory.dmp

    Filesize

    316KB

    Download

  • memory/1300-5-0x00000000002C0000-0x00000000002C8000-memory.dmp

    Filesize

    32KB

    Download

  • memory/1300-7-0x0000000078A30000-0x0000000078A7F2E0-memory.dmp

    Filesize

    316KB

    Download

  • memory/3020-6-0x0000000000400000-0x0000000000427000-memory.dmp

    Filesize

    156KB

    Download

  • memory/3020-9-0x0000000000400000-0x0000000000427000-memory.dmp

    Filesize

    156KB

    Download

  • memory/3020-11-0x0000000000400000-0x0000000000427000-memory.dmp

    Filesize

    156KB

    Download

  • memory/3020-13-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

    Download