Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
15-12-2024 19:34
General
-
Target
f57014ec711002b637697be806394a3c_JaffaCakes118.exe
-
Size
389KB
-
MD5
f57014ec711002b637697be806394a3c
-
SHA1
bd34d56b9b685e3238552d69a733050268c9a921
-
SHA256
09d58d081dd9364e99857ac273d52a17a0473cc64e64d0e15b2b9b2f67ef2d49
-
SHA512
ed9d6ce7f2da002e409c10f8046d95b69800dfffbc9b8d8805cf26f136849bf471aa8c7fd2d9abecfb80cac8986ba1247ef0ad40bcc33e8e2b7da7245bfb6b0f
-
SSDEEP
12288:sA3AHAI6tB+ysm4T68rbe0fsep3F5OBQTT04:sgI6tBpsmQreC7T04
Malware Config
Extracted
redline
SewPalpadin
185.215.113.114:8887
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
-
Redline family
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload 2 IoCs
-
Sectoprat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f57014ec711002b637697be806394a3c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f57014ec711002b637697be806394a3c_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
200KB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
128KB
-
Filesize
120KB
-
Filesize
1024KB
-
Filesize
200KB