redline | c0106f208713f7d49ec131336406dd1d0af5b1dbda9bb4e94b2dc9439104863b

Analysis

max time kernel
132s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16-07-2024 11:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe
Size

321KB
MD5

4e1868e7601e5cb9f6d454758df69c99
SHA1

dfa929d27d132dec3532f84ef44957fcbb2e8b28
SHA256

c0106f208713f7d49ec131336406dd1d0af5b1dbda9bb4e94b2dc9439104863b
SHA512

12414ec1d76d22ea44b55f70a489eda7ee6692a6ea1a7f5d439f62afc24ca8cab48483b0b429b3b954fae1928404427cf09106a5fbfed6966251f0ed95a2e7c5
SSDEEP

3072:r64XAlTrgcLSsfqdleoLBu6v1p2x+xpp3xG3H92WlxfvvG3J:O1ksMrBHtpVBG3H9Lf3

Score

10^/10

redline sectoprat cryptbuild infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

CryptBuild

46.175.146.11:41600

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2276-6-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2276-6-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

Suspicious use of SetThreadContext 1 IoCs

Processes:

4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe

description	pid	process	target process
PID 1048 set thread context of 2276	1048	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4404 1048 WerFault.exe 4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe

pid	pid_target	process	target process
4404	1048	WerFault.exe	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	1048	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe
Token: SeDebugPrivilege	2276	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe

description	pid	process	target process
PID 1048 wrote to memory of 2276	1048	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe
PID 1048 wrote to memory of 2276	1048	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe
PID 1048 wrote to memory of 2276	1048	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe
PID 1048 wrote to memory of 2276	1048	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe
PID 1048 wrote to memory of 2276	1048	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe
PID 1048 wrote to memory of 2276	1048	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe
PID 1048 wrote to memory of 2276	1048	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe
PID 1048 wrote to memory of 2276	1048	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe	4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1048

C:\Users\Admin\AppData\Local\Temp\4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4e1868e7601e5cb9f6d454758df69c99_JaffaCakes118.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 896
2⤵
- Program crash
PID:4404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1048 -ip 1048
1⤵
PID:1500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1048-0-0x000000007529E000-0x000000007529F000-memory.dmp

Filesize
4KB

Download
memory/1048-1-0x0000000000F90000-0x0000000000FE6000-memory.dmp

Filesize
344KB

Download
memory/1048-2-0x0000000003230000-0x000000000324C000-memory.dmp

Filesize
112KB

Download
memory/1048-3-0x00000000058A0000-0x000000000593C000-memory.dmp

Filesize
624KB

Download
memory/1048-4-0x0000000005EF0000-0x0000000006494000-memory.dmp

Filesize
5.6MB

Download
memory/1048-5-0x0000000075290000-0x0000000075A40000-memory.dmp

Filesize
7.7MB

Download
memory/1048-16-0x0000000075290000-0x0000000075A40000-memory.dmp

Filesize
7.7MB

Download
memory/1048-7-0x0000000005870000-0x0000000005878000-memory.dmp

Filesize
32KB

Download
memory/2276-9-0x0000000075290000-0x0000000075A40000-memory.dmp

Filesize
7.7MB

Download
memory/2276-10-0x0000000005BC0000-0x00000000061D8000-memory.dmp

Filesize
6.1MB

Download
memory/2276-11-0x00000000055A0000-0x00000000055B2000-memory.dmp

Filesize
72KB

Download
memory/2276-12-0x0000000005600000-0x000000000563C000-memory.dmp

Filesize
240KB

Download
memory/2276-14-0x0000000005640000-0x000000000568C000-memory.dmp

Filesize
304KB

Download
memory/2276-13-0x0000000075290000-0x0000000075A40000-memory.dmp

Filesize
7.7MB

Download
memory/2276-15-0x0000000005890000-0x000000000599A000-memory.dmp

Filesize
1.0MB

Download
memory/2276-6-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2276-17-0x0000000075290000-0x0000000075A40000-memory.dmp

Filesize
7.7MB

Download