Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
09-07-2024 23:28
Static task
static1
Behavioral task
behavioral1
Sample
326c915977a42370e806178161e060b4_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
326c915977a42370e806178161e060b4_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
326c915977a42370e806178161e060b4_JaffaCakes118.exe
-
Size
1.5MB
-
MD5
326c915977a42370e806178161e060b4
-
SHA1
140bf2bcbc2845f65674fab1e29407da5b869bf8
-
SHA256
e7dfb670bb6407f251b3e83ffd83332184fa12f47ead9a5cad529adb88f835d9
-
SHA512
fb392af38f76c9da3352afc4034eb1233ce9ee8e81f49899f12e4d1860f016a9df5fc3d8c98bf68e6624220da32025d5d6265836eed1e6bed111931f89d7b20d
-
SSDEEP
49152:iZLAulCktXMNVWczmH5F1/ryMW4qxvaeX:MCktozm1rNW4qxva
Malware Config
Extracted
redline
@hmmmm2224
185.213.209.36:36533
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3732-10-0x0000000000400000-0x0000000000422000-memory.dmp family_redline -
SectopRAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3732-10-0x0000000000400000-0x0000000000422000-memory.dmp family_sectoprat -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
326c915977a42370e806178161e060b4_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 326c915977a42370e806178161e060b4_JaffaCakes118.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
326c915977a42370e806178161e060b4_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 326c915977a42370e806178161e060b4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 326c915977a42370e806178161e060b4_JaffaCakes118.exe -
Processes:
326c915977a42370e806178161e060b4_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 326c915977a42370e806178161e060b4_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
326c915977a42370e806178161e060b4_JaffaCakes118.exedescription pid process target process PID 536 set thread context of 3732 536 326c915977a42370e806178161e060b4_JaffaCakes118.exe RegSvcs.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
326c915977a42370e806178161e060b4_JaffaCakes118.exedescription pid process target process PID 536 wrote to memory of 3732 536 326c915977a42370e806178161e060b4_JaffaCakes118.exe RegSvcs.exe PID 536 wrote to memory of 3732 536 326c915977a42370e806178161e060b4_JaffaCakes118.exe RegSvcs.exe PID 536 wrote to memory of 3732 536 326c915977a42370e806178161e060b4_JaffaCakes118.exe RegSvcs.exe PID 536 wrote to memory of 3732 536 326c915977a42370e806178161e060b4_JaffaCakes118.exe RegSvcs.exe PID 536 wrote to memory of 3732 536 326c915977a42370e806178161e060b4_JaffaCakes118.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\326c915977a42370e806178161e060b4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\326c915977a42370e806178161e060b4_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/536-16-0x00000000003E0000-0x00000000008B4000-memory.dmpFilesize
4.8MB
-
memory/536-7-0x00000000003E0000-0x00000000008B4000-memory.dmpFilesize
4.8MB
-
memory/536-4-0x00000000003E0000-0x00000000008B4000-memory.dmpFilesize
4.8MB
-
memory/536-6-0x00000000003E0000-0x00000000008B4000-memory.dmpFilesize
4.8MB
-
memory/536-5-0x00000000003E0000-0x00000000008B4000-memory.dmpFilesize
4.8MB
-
memory/536-2-0x00000000003E0000-0x00000000008B4000-memory.dmpFilesize
4.8MB
-
memory/536-1-0x00000000003E0000-0x00000000008B4000-memory.dmpFilesize
4.8MB
-
memory/536-0-0x00000000003E0000-0x00000000008B4000-memory.dmpFilesize
4.8MB
-
memory/536-14-0x0000000000C00000-0x0000000000D00000-memory.dmpFilesize
1024KB
-
memory/536-3-0x00000000003E0000-0x00000000008B4000-memory.dmpFilesize
4.8MB
-
memory/3732-23-0x0000000005210000-0x000000000525C000-memory.dmpFilesize
304KB
-
memory/3732-17-0x00000000753AE000-0x00000000753AF000-memory.dmpFilesize
4KB
-
memory/3732-18-0x00000000056B0000-0x0000000005CC8000-memory.dmpFilesize
6.1MB
-
memory/3732-19-0x0000000005140000-0x0000000005152000-memory.dmpFilesize
72KB
-
memory/3732-20-0x0000000005270000-0x000000000537A000-memory.dmpFilesize
1.0MB
-
memory/3732-21-0x00000000051A0000-0x00000000051DC000-memory.dmpFilesize
240KB
-
memory/3732-22-0x00000000753A0000-0x0000000075B50000-memory.dmpFilesize
7.7MB
-
memory/3732-25-0x00000000753A0000-0x0000000075B50000-memory.dmpFilesize
7.7MB
-
memory/3732-24-0x00000000753AE000-0x00000000753AF000-memory.dmpFilesize
4KB
-
memory/3732-10-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB