Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-07-2024 12:40

General

  • Target

    2269e9421374a2d98c7f69153a5ca647_JaffaCakes118.exe

  • Size

    366KB

  • MD5

    2269e9421374a2d98c7f69153a5ca647

  • SHA1

    18a8bf91b7b121b617921ab3e8acf79599a353a0

  • SHA256

    f59e70c1e2703fd8d6016bad2f6b4ebd7824b52eab2bf63a0fdc96f0a3d16011

  • SHA512

    67226e0be2c2b913bc7f2a36ea1afea7afd469ecba4ac2ec7c337918db37d028c664e13c6abd2b6af56ba5f211524942891e9c4de6adb25a8b4adc9b4279ea98

  • SSDEEP

    6144:mV9qgzGpmE2fOz417Fdix5i2jsKcpq7nCwvROhxxpeTr/ekIw:aqgzGwE2fOz4Ux5i2jsKx7Cw0zxp6L

Malware Config

Extracted

Family

redline

Botnet

build

C2

185.244.182.136:51832

Attributes
  • auth_value

    275ce2c87153d4e8e3cc276c686a93de

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2269e9421374a2d98c7f69153a5ca647_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2269e9421374a2d98c7f69153a5ca647_JaffaCakes118.exe"
    1⤵
      PID:4108

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4108-1-0x00000000004A0000-0x00000000005A0000-memory.dmp

      Filesize

      1024KB

    • memory/4108-3-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4108-2-0x00000000001C0000-0x00000000001F0000-memory.dmp

      Filesize

      192KB

    • memory/4108-4-0x0000000000400000-0x0000000000469000-memory.dmp

      Filesize

      420KB

    • memory/4108-5-0x00000000021D0000-0x00000000021F4000-memory.dmp

      Filesize

      144KB

    • memory/4108-6-0x0000000004DF0000-0x0000000005394000-memory.dmp

      Filesize

      5.6MB

    • memory/4108-7-0x00000000022A0000-0x00000000022C2000-memory.dmp

      Filesize

      136KB

    • memory/4108-8-0x0000000002780000-0x0000000002812000-memory.dmp

      Filesize

      584KB

    • memory/4108-9-0x00000000053A0000-0x00000000059B8000-memory.dmp

      Filesize

      6.1MB

    • memory/4108-10-0x00000000070B0000-0x00000000070C2000-memory.dmp

      Filesize

      72KB

    • memory/4108-11-0x00000000070D0000-0x00000000071DA000-memory.dmp

      Filesize

      1.0MB

    • memory/4108-12-0x0000000007330000-0x000000000736C000-memory.dmp

      Filesize

      240KB

    • memory/4108-13-0x0000000007480000-0x00000000074CC000-memory.dmp

      Filesize

      304KB

    • memory/4108-15-0x00000000004A0000-0x00000000005A0000-memory.dmp

      Filesize

      1024KB