Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 23:51
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_172bbc387e453f3b5f9df871aaa0d49bddc8bb9218445db58342ee1741141c85.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_172bbc387e453f3b5f9df871aaa0d49bddc8bb9218445db58342ee1741141c85.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_172bbc387e453f3b5f9df871aaa0d49bddc8bb9218445db58342ee1741141c85.exe
-
Size
715.0MB
-
MD5
c1f41959bc165b2d2552c5b00396073d
-
SHA1
51438768ed8a9e0788c22e022841d8b99814d901
-
SHA256
172bbc387e453f3b5f9df871aaa0d49bddc8bb9218445db58342ee1741141c85
-
SHA512
88bf4ff35b34d9c0333f490f1a6035ab7a8be0eb3c08266946c9cfbe52fc9a788de055921177a95be149fb2b8d280fd8d0254476b8518b84316bc51a7a4934c7
-
SSDEEP
24576:MptWrkUP/1F51MfojHpez56/ODIi7kR60DckhX:K3UH7DKAIbki7y9hX
Malware Config
Extracted
redline
CRYPT BY META
89.107.10.226:37141
-
auth_value
31efbabdcfc797323e09a896b4808afe
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral1/memory/2592-1-0x0000000000740000-0x0000000000768000-memory.dmp family_redline -
Redline family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_172bbc387e453f3b5f9df871aaa0d49bddc8bb9218445db58342ee1741141c85.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_172bbc387e453f3b5f9df871aaa0d49bddc8bb9218445db58342ee1741141c85.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_172bbc387e453f3b5f9df871aaa0d49bddc8bb9218445db58342ee1741141c85.exe"1⤵
- System Location Discovery: System Language Discovery
PID:2592