Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20-09-2024 20:17

General

  • Target

    ee5a09994d9f7a30c635dcb912e80e3b_JaffaCakes118.exe

  • Size

    367KB

  • MD5

    ee5a09994d9f7a30c635dcb912e80e3b

  • SHA1

    bd4b294077726f706f8f9bac13a2f4e539a3f35f

  • SHA256

    e03fafad4f9ad1aee248fa501cab22283f8e1a22d920bf8b600a06bfedaba966

  • SHA512

    b6f42d787e3e10f69a541605c63844067b77f6550795ca8af26cda1278caa9d3a29b91f84592faffd113581a2af6c3722a3bacf47bb16ab1287a3636d33351fe

  • SSDEEP

    6144:Usj9FM045LE2CAL9xmGhh1leQPROhxxpeTr/ekI:p9FMn9hCqeGh5DUzxp6L

Malware Config

Extracted

Family

redline

Botnet

SewPalpadin

C2

185.215.113.29:18087

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\ee5a09994d9f7a30c635dcb912e80e3b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ee5a09994d9f7a30c635dcb912e80e3b_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2100

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2100-2-0x00000000003C0000-0x00000000003F0000-memory.dmp

    Filesize

    192KB

  • memory/2100-1-0x0000000000250000-0x0000000000350000-memory.dmp

    Filesize

    1024KB

  • memory/2100-3-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2100-4-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

  • memory/2100-5-0x0000000000590000-0x00000000005B6000-memory.dmp

    Filesize

    152KB

  • memory/2100-6-0x0000000001F00000-0x0000000001F24000-memory.dmp

    Filesize

    144KB

  • memory/2100-7-0x0000000000250000-0x0000000000350000-memory.dmp

    Filesize

    1024KB

  • memory/2100-8-0x00000000003C0000-0x00000000003F0000-memory.dmp

    Filesize

    192KB

  • memory/2100-9-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB