Analysis

  • max time kernel
    136s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    06-10-2024 09:56

General

  • Target

    179dbbdb6e22f978115168d87a70ab33_JaffaCakes118.exe

  • Size

    356KB

  • MD5

    179dbbdb6e22f978115168d87a70ab33

  • SHA1

    324a73e17fdcada034d3ad841286f9d6b5873fcb

  • SHA256

    258445b5c086f67d1157c2998968bad83a64ca3bab88bfd9d73654819bb46463

  • SHA512

    237a58b819f086f9ed2215e99d7b13ed027d252e47a3ba17deb5b28e3db27f853f2d2d75bdbfb3b875dec8dc0fa4fb059e3be6e41dc3b47b2020c2298a6b0358

  • SSDEEP

    6144:zo9QlVmhcIS/rwO+l7qYspB2NnYXmJ8tuy2a9W17fyF45pDBKoydJ:zdxrwHRqxQNYXO8tt2aw1DyWPDO

Malware Config

Extracted

Family

redline

Botnet

@bestiefFcs

C2

37.1.213.214:63028

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 1 IoCs
  • System Binary Proxy Execution: Regsvcs/Regasm 1 TTPs 2 IoCs

    Abuse Regasm to proxy execution of malicious code.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 44 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\179dbbdb6e22f978115168d87a70ab33_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\179dbbdb6e22f978115168d87a70ab33_JaffaCakes118.exe"
    1⤵
    • System Binary Proxy Execution: Regsvcs/Regasm
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2956
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:896
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2556
    • C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
      C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:11728

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZML68D2X6NJXQTJGKMFG.temp

    Filesize

    7KB

    MD5

    cd9a7bfb2d8e555767196da38c0c9847

    SHA1

    74c67d44d8e0ba45c07547ef501243bc2bea5e62

    SHA256

    1af434d484130e8aad3d622efe4e73c8840418d6eba28e593ff0c1263b87a360

    SHA512

    3d1e8340aa9db92adeb8141ee009a7cd1f6e55c50362a9cbe21477241c2d58e56a4a9c6c65141840f3eb58a74a08282feb29d88106b73ed4e7286252ce4fa164

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    69512e86988e7745483bdb0ecbf8d1ca

    SHA1

    9b6a6e0b06c0470bbe76603a4ef4414c11915f77

    SHA256

    1f6d76bfd9ca4c03640432f08b884b38f3108319bdbc66e499c7c93da0fb783f

    SHA512

    6bf20c63125b691de706efde1be4c65b1f320bd1638241b99f10a4879daf476b3653071c93738e16f3b9091372a78d9047528f1cb433eda3504d80ba30a33a54

  • \Users\Admin\AppData\Local\Temp\RegAsm.exe

    Filesize

    63KB

    MD5

    b58b926c3574d28d5b7fdd2ca3ec30d5

    SHA1

    d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

    SHA256

    6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

    SHA512

    b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

  • memory/896-5-0x0000000002A30000-0x0000000002A70000-memory.dmp

    Filesize

    256KB

  • memory/2956-53-0x0000000004C60000-0x0000000004CDA000-memory.dmp

    Filesize

    488KB

  • memory/2956-77-0x0000000004C60000-0x0000000004CDA000-memory.dmp

    Filesize

    488KB

  • memory/2956-2-0x00000000747F0000-0x0000000074EDE000-memory.dmp

    Filesize

    6.9MB

  • memory/2956-49-0x0000000004C60000-0x0000000004CDA000-memory.dmp

    Filesize

    488KB

  • memory/2956-13-0x0000000004C60000-0x0000000004CE0000-memory.dmp

    Filesize

    512KB

  • memory/2956-45-0x0000000004C60000-0x0000000004CDA000-memory.dmp

    Filesize

    488KB

  • memory/2956-68-0x0000000004C60000-0x0000000004CDA000-memory.dmp

    Filesize

    488KB

  • memory/2956-47-0x0000000004C60000-0x0000000004CDA000-memory.dmp

    Filesize

    488KB

  • memory/2956-75-0x0000000004C60000-0x0000000004CDA000-memory.dmp

    Filesize

    488KB

  • memory/2956-73-0x0000000004C60000-0x0000000004CDA000-memory.dmp

    Filesize

    488KB

  • memory/2956-71-0x0000000004C60000-0x0000000004CDA000-memory.dmp

    Filesize

    488KB

  • memory/2956-69-0x0000000004C60000-0x0000000004CDA000-memory.dmp

    Filesize

    488KB

  • memory/2956-65-0x0000000004C60000-0x0000000004CDA000-memory.dmp

    Filesize

    488KB

  • memory/2956-63-0x0000000004C60000-0x0000000004CDA000-memory.dmp

    Filesize

    488KB

  • memory/2956-61-0x0000000004C60000-0x0000000004CDA000-memory.dmp

    Filesize

    488KB

  • memory/2956-59-0x0000000004C60000-0x0000000004CDA000-memory.dmp

    Filesize

    488KB

  • memory/2956-57-0x0000000004C60000-0x0000000004CDA000-memory.dmp

    Filesize

    488KB

  • memory/2956-55-0x0000000004C60000-0x0000000004CDA000-memory.dmp

    Filesize

    488KB

  • memory/2956-0-0x00000000747FE000-0x00000000747FF000-memory.dmp

    Filesize

    4KB

  • memory/2956-51-0x0000000004C60000-0x0000000004CDA000-memory.dmp

    Filesize

    488KB

  • memory/2956-12-0x0000000000DD0000-0x0000000000E26000-memory.dmp

    Filesize

    344KB

  • memory/2956-6-0x00000000747F0000-0x0000000074EDE000-memory.dmp

    Filesize

    6.9MB

  • memory/2956-37-0x0000000004C60000-0x0000000004CDA000-memory.dmp

    Filesize

    488KB

  • memory/2956-43-0x0000000004C60000-0x0000000004CDA000-memory.dmp

    Filesize

    488KB

  • memory/2956-41-0x0000000004C60000-0x0000000004CDA000-memory.dmp

    Filesize

    488KB

  • memory/2956-39-0x0000000004C60000-0x0000000004CDA000-memory.dmp

    Filesize

    488KB

  • memory/2956-35-0x0000000004C60000-0x0000000004CDA000-memory.dmp

    Filesize

    488KB

  • memory/2956-33-0x0000000004C60000-0x0000000004CDA000-memory.dmp

    Filesize

    488KB

  • memory/2956-31-0x0000000004C60000-0x0000000004CDA000-memory.dmp

    Filesize

    488KB

  • memory/2956-29-0x0000000004C60000-0x0000000004CDA000-memory.dmp

    Filesize

    488KB

  • memory/2956-27-0x0000000004C60000-0x0000000004CDA000-memory.dmp

    Filesize

    488KB

  • memory/2956-25-0x0000000004C60000-0x0000000004CDA000-memory.dmp

    Filesize

    488KB

  • memory/2956-23-0x0000000004C60000-0x0000000004CDA000-memory.dmp

    Filesize

    488KB

  • memory/2956-21-0x0000000004C60000-0x0000000004CDA000-memory.dmp

    Filesize

    488KB

  • memory/2956-19-0x0000000004C60000-0x0000000004CDA000-memory.dmp

    Filesize

    488KB

  • memory/2956-17-0x0000000004C60000-0x0000000004CDA000-memory.dmp

    Filesize

    488KB

  • memory/2956-15-0x0000000004C60000-0x0000000004CDA000-memory.dmp

    Filesize

    488KB

  • memory/2956-14-0x0000000004C60000-0x0000000004CDA000-memory.dmp

    Filesize

    488KB

  • memory/2956-1-0x00000000011B0000-0x000000000120C000-memory.dmp

    Filesize

    368KB

  • memory/2956-2514-0x00000000747F0000-0x0000000074EDE000-memory.dmp

    Filesize

    6.9MB

  • memory/11728-2516-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB