Analysis

  • max time kernel
    147s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-09-2024 18:57

General

  • Target

    e77ee5479b6e8da5b7f09dfac202647f_JaffaCakes118.exe

  • Size

    298KB

  • MD5

    e77ee5479b6e8da5b7f09dfac202647f

  • SHA1

    c61d85632f576e96dbc2dde78eff64c08f2858d9

  • SHA256

    756151e99176d79019cc0e9c44b5ed9fd81d890d0fd51e49806aeb1f5c8fd8d9

  • SHA512

    b568dd024146a9cc53860b67fa492eb1e961b9fbb75cc2b3d893253be50f399f4562f6903524894a553e5ed91b16966dea4b01de9260a83947356904a52cf832

  • SSDEEP

    6144:nbdT3QrOeIyAQgtpy5u+eCHNHlOMx2scNZn+8:BT3QiPQg/+us8PsW9

Malware Config

Extracted

Family

redline

Botnet

@Crypto4ok

C2

185.213.209.36:36533

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e77ee5479b6e8da5b7f09dfac202647f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e77ee5479b6e8da5b7f09dfac202647f_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1008
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMgAwAA==
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3668
    • C:\Users\Admin\AppData\Local\Temp\e77ee5479b6e8da5b7f09dfac202647f_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\e77ee5479b6e8da5b7f09dfac202647f_JaffaCakes118.exe
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2504
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4288,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:8
    1⤵
      PID:4980

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\e77ee5479b6e8da5b7f09dfac202647f_JaffaCakes118.exe.log

      Filesize

      1KB

      MD5

      7ebe314bf617dc3e48b995a6c352740c

      SHA1

      538f643b7b30f9231a3035c448607f767527a870

      SHA256

      48178f884b8a4dd96e330b210b0530667d9473a7629fc6b4ad12b614bf438ee8

      SHA512

      0ba9d8f4244c15285e254d27b4bff7c49344ff845c48bc0bf0d8563072fab4d6f7a6abe6b6742e8375a08e9a3b3e5d5dc4937ab428dbe2dd8e62892fda04507e

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rptlubyh.31w.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • memory/1008-29-0x0000000074760000-0x0000000074F10000-memory.dmp

      Filesize

      7.7MB

    • memory/1008-3-0x0000000005620000-0x00000000056B2000-memory.dmp

      Filesize

      584KB

    • memory/1008-4-0x0000000074760000-0x0000000074F10000-memory.dmp

      Filesize

      7.7MB

    • memory/1008-5-0x00000000055F0000-0x00000000055FA000-memory.dmp

      Filesize

      40KB

    • memory/1008-2-0x0000000005BD0000-0x0000000006174000-memory.dmp

      Filesize

      5.6MB

    • memory/1008-28-0x000000007476E000-0x000000007476F000-memory.dmp

      Filesize

      4KB

    • memory/1008-36-0x00000000059A0000-0x00000000059BC000-memory.dmp

      Filesize

      112KB

    • memory/1008-0-0x000000007476E000-0x000000007476F000-memory.dmp

      Filesize

      4KB

    • memory/1008-35-0x00000000069F0000-0x0000000006A2A000-memory.dmp

      Filesize

      232KB

    • memory/1008-40-0x0000000074760000-0x0000000074F10000-memory.dmp

      Filesize

      7.7MB

    • memory/1008-1-0x0000000000BF0000-0x0000000000C40000-memory.dmp

      Filesize

      320KB

    • memory/2504-45-0x0000000074760000-0x0000000074F10000-memory.dmp

      Filesize

      7.7MB

    • memory/2504-42-0x0000000005600000-0x0000000005C18000-memory.dmp

      Filesize

      6.1MB

    • memory/2504-41-0x0000000074760000-0x0000000074F10000-memory.dmp

      Filesize

      7.7MB

    • memory/2504-43-0x0000000005090000-0x00000000050A2000-memory.dmp

      Filesize

      72KB

    • memory/2504-44-0x00000000051C0000-0x00000000052CA000-memory.dmp

      Filesize

      1.0MB

    • memory/2504-37-0x0000000000400000-0x0000000000422000-memory.dmp

      Filesize

      136KB

    • memory/2504-46-0x00000000050F0000-0x000000000512C000-memory.dmp

      Filesize

      240KB

    • memory/2504-47-0x0000000005130000-0x000000000517C000-memory.dmp

      Filesize

      304KB

    • memory/2504-48-0x0000000074760000-0x0000000074F10000-memory.dmp

      Filesize

      7.7MB

    • memory/3668-9-0x0000000074760000-0x0000000074F10000-memory.dmp

      Filesize

      7.7MB

    • memory/3668-34-0x0000000074760000-0x0000000074F10000-memory.dmp

      Filesize

      7.7MB

    • memory/3668-30-0x0000000074760000-0x0000000074F10000-memory.dmp

      Filesize

      7.7MB

    • memory/3668-27-0x0000000006530000-0x000000000654A000-memory.dmp

      Filesize

      104KB

    • memory/3668-26-0x00000000076A0000-0x0000000007D1A000-memory.dmp

      Filesize

      6.5MB

    • memory/3668-25-0x00000000060C0000-0x000000000610C000-memory.dmp

      Filesize

      304KB

    • memory/3668-24-0x0000000006030000-0x000000000604E000-memory.dmp

      Filesize

      120KB

    • memory/3668-23-0x00000000059D0000-0x0000000005D24000-memory.dmp

      Filesize

      3.3MB

    • memory/3668-13-0x00000000058E0000-0x0000000005946000-memory.dmp

      Filesize

      408KB

    • memory/3668-12-0x0000000005870000-0x00000000058D6000-memory.dmp

      Filesize

      408KB

    • memory/3668-11-0x00000000057D0000-0x00000000057F2000-memory.dmp

      Filesize

      136KB

    • memory/3668-10-0x0000000074760000-0x0000000074F10000-memory.dmp

      Filesize

      7.7MB

    • memory/3668-8-0x00000000051A0000-0x00000000057C8000-memory.dmp

      Filesize

      6.2MB

    • memory/3668-7-0x0000000074760000-0x0000000074F10000-memory.dmp

      Filesize

      7.7MB

    • memory/3668-6-0x0000000004A80000-0x0000000004AB6000-memory.dmp

      Filesize

      216KB