redline | c0106f208713f7d49ec131336406dd1d0af5b1dbda9bb4e94b2dc9439104863b

General

Target

4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe
Size

321KB
MD5

4e1868e7601e5cb9f6d454758df69c99
SHA1

dfa929d27d132dec3532f84ef44957fcbb2e8b28
SHA256

c0106f208713f7d49ec131336406dd1d0af5b1dbda9bb4e94b2dc9439104863b
SHA512

12414ec1d76d22ea44b55f70a489eda7ee6692a6ea1a7f5d439f62afc24ca8cab48483b0b429b3b954fae1928404427cf09106a5fbfed6966251f0ed95a2e7c5
SSDEEP

3072:r64XAlTrgcLSsfqdleoLBu6v1p2x+xpp3xG3H92WlxfvvG3J:O1ksMrBHtpVBG3H9Lf3

Score

10^/10

redline sectoprat cryptbuild infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

CryptBuild

C2

46.175.146.11:41600

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2888-14-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2888-10-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2888-8-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2888-19-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2888-17-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2888-14-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2888-10-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2888-8-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2888-19-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2888-17-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

Suspicious use of SetThreadContext 1 IoCs

Processes:

4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe

description	pid	process	target process
PID 2176 set thread context of 2888	2176	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2636 2176 WerFault.exe 4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe

pid	pid_target	process	target process
2636	2176	WerFault.exe	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2176	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe
Token: SeDebugPrivilege	2888	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe

description	pid	process	target process
PID 2176 wrote to memory of 2888	2176	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe
PID 2176 wrote to memory of 2888	2176	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe
PID 2176 wrote to memory of 2888	2176	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe
PID 2176 wrote to memory of 2888	2176	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe
PID 2176 wrote to memory of 2888	2176	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe
PID 2176 wrote to memory of 2888	2176	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe
PID 2176 wrote to memory of 2888	2176	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe
PID 2176 wrote to memory of 2888	2176	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe
PID 2176 wrote to memory of 2888	2176	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe
PID 2176 wrote to memory of 2636	2176	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe	WerFault.exe
PID 2176 wrote to memory of 2636	2176	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe	WerFault.exe
PID 2176 wrote to memory of 2636	2176	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe	WerFault.exe
PID 2176 wrote to memory of 2636	2176	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176

C:\Users\Admin\AppData\Local\Temp\4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 572
2⤵
- Program crash
PID:2636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2176-0-0x000000007424E000-0x000000007424F000-memory.dmp

Filesize
4KB

Download
memory/2176-1-0x0000000000830000-0x0000000000886000-memory.dmp

Filesize
344KB

Download
memory/2176-2-0x00000000002E0000-0x00000000002FC000-memory.dmp

Filesize
112KB

Download
memory/2176-24-0x0000000074240000-0x000000007492E000-memory.dmp

Filesize
6.9MB

Download
memory/2176-23-0x000000007424E000-0x000000007424F000-memory.dmp

Filesize
4KB

Download
memory/2176-15-0x00000000004A0000-0x00000000004A8000-memory.dmp

Filesize
32KB

Download
memory/2176-3-0x0000000074240000-0x000000007492E000-memory.dmp

Filesize
6.9MB

Download
memory/2888-6-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2888-8-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2888-10-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2888-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2888-19-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2888-17-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2888-21-0x0000000074240000-0x000000007492E000-memory.dmp

Filesize
6.9MB

Download
memory/2888-22-0x0000000074240000-0x000000007492E000-memory.dmp

Filesize
6.9MB

Download
memory/2888-14-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2888-4-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2888-25-0x0000000074240000-0x000000007492E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads