Analysis

  • max time kernel
    132s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-12-2024 20:49

General

  • Target

    JaffaCakes118_26ed6ae958948dfcb4309435e14d118dbd6de6a723757e926ec84d5a6ff69920.exe

  • Size

    700.0MB

  • MD5

    d10f5b81ee28bab98ad9a9568361ae0f

  • SHA1

    1c62ff02925c3c6158eee29d489480f484c26f54

  • SHA256

    26ed6ae958948dfcb4309435e14d118dbd6de6a723757e926ec84d5a6ff69920

  • SHA512

    90645fe06a5a889c665a68ed066199e5ef46aa1a90a93807c6c473dedef04526c8a863a02f15c87f77fc732dc8a0a96f4447eeee2fb5777e1dd3d0d9f9e3629c

  • SSDEEP

    24576:miy6cuKXLR7o7PG+m7dm2e5nYQb6VO5gKw7p:m9p

Malware Config

Extracted

Family

redline

Botnet

yt1310

C2

62.204.41.139:25190

Attributes
  • auth_value

    d628300d830fa8afddf930fedaf1f85b

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_26ed6ae958948dfcb4309435e14d118dbd6de6a723757e926ec84d5a6ff69920.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_26ed6ae958948dfcb4309435e14d118dbd6de6a723757e926ec84d5a6ff69920.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4552
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQA1AA==
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4232
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_26ed6ae958948dfcb4309435e14d118dbd6de6a723757e926ec84d5a6ff69920.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_26ed6ae958948dfcb4309435e14d118dbd6de6a723757e926ec84d5a6ff69920.exe
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5848

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\JaffaCakes118_26ed6ae958948dfcb4309435e14d118dbd6de6a723757e926ec84d5a6ff69920.exe.log

    Filesize

    1KB

    MD5

    123391f24d13e2a1a33bfcf40cb9515d

    SHA1

    51b34f406e14267b3411d0d1f8f4ca4ee26554c1

    SHA256

    1d84535b13dee8f497357ac03a5bad436fed1be6554348865a29b5dadb2c7075

    SHA512

    f942e3319742b9943e0f28978483cc373b46605e7e56009006873569de137c144995a7411d45efd0da0c423a4f929de7145526b5cc6ce7d072d8e37cae658c7d

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4nxpnibu.3sx.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/4232-2077-0x00000000743F0000-0x0000000074BA0000-memory.dmp

    Filesize

    7.7MB

  • memory/4232-2056-0x00000000027B0000-0x00000000027E6000-memory.dmp

    Filesize

    216KB

  • memory/4232-2074-0x0000000006290000-0x00000000062AA000-memory.dmp

    Filesize

    104KB

  • memory/4232-2073-0x0000000007360000-0x00000000079DA000-memory.dmp

    Filesize

    6.5MB

  • memory/4232-2072-0x0000000005E40000-0x0000000005E8C000-memory.dmp

    Filesize

    304KB

  • memory/4232-2071-0x0000000005D90000-0x0000000005DAE000-memory.dmp

    Filesize

    120KB

  • memory/4232-2060-0x00000000054C0000-0x0000000005526000-memory.dmp

    Filesize

    408KB

  • memory/4232-2081-0x00000000743F0000-0x0000000074BA0000-memory.dmp

    Filesize

    7.7MB

  • memory/4232-2066-0x0000000005720000-0x0000000005786000-memory.dmp

    Filesize

    408KB

  • memory/4232-2059-0x00000000743F0000-0x0000000074BA0000-memory.dmp

    Filesize

    7.7MB

  • memory/4232-2057-0x0000000004E90000-0x00000000054B8000-memory.dmp

    Filesize

    6.2MB

  • memory/4232-2058-0x00000000743F0000-0x0000000074BA0000-memory.dmp

    Filesize

    7.7MB

  • memory/4552-62-0x0000000006DB0000-0x0000000006E76000-memory.dmp

    Filesize

    792KB

  • memory/4552-9-0x0000000006DB0000-0x0000000006E76000-memory.dmp

    Filesize

    792KB

  • memory/4552-64-0x0000000006DB0000-0x0000000006E76000-memory.dmp

    Filesize

    792KB

  • memory/4552-0-0x00000000743FE000-0x00000000743FF000-memory.dmp

    Filesize

    4KB

  • memory/4552-60-0x0000000006DB0000-0x0000000006E76000-memory.dmp

    Filesize

    792KB

  • memory/4552-54-0x0000000006DB0000-0x0000000006E76000-memory.dmp

    Filesize

    792KB

  • memory/4552-52-0x0000000006DB0000-0x0000000006E76000-memory.dmp

    Filesize

    792KB

  • memory/4552-50-0x0000000006DB0000-0x0000000006E76000-memory.dmp

    Filesize

    792KB

  • memory/4552-48-0x0000000006DB0000-0x0000000006E76000-memory.dmp

    Filesize

    792KB

  • memory/4552-46-0x0000000006DB0000-0x0000000006E76000-memory.dmp

    Filesize

    792KB

  • memory/4552-44-0x0000000006DB0000-0x0000000006E76000-memory.dmp

    Filesize

    792KB

  • memory/4552-42-0x0000000006DB0000-0x0000000006E76000-memory.dmp

    Filesize

    792KB

  • memory/4552-40-0x0000000006DB0000-0x0000000006E76000-memory.dmp

    Filesize

    792KB

  • memory/4552-38-0x0000000006DB0000-0x0000000006E76000-memory.dmp

    Filesize

    792KB

  • memory/4552-36-0x0000000006DB0000-0x0000000006E76000-memory.dmp

    Filesize

    792KB

  • memory/4552-34-0x0000000006DB0000-0x0000000006E76000-memory.dmp

    Filesize

    792KB

  • memory/4552-30-0x0000000006DB0000-0x0000000006E76000-memory.dmp

    Filesize

    792KB

  • memory/4552-28-0x0000000006DB0000-0x0000000006E76000-memory.dmp

    Filesize

    792KB

  • memory/4552-26-0x0000000006DB0000-0x0000000006E76000-memory.dmp

    Filesize

    792KB

  • memory/4552-25-0x0000000006DB0000-0x0000000006E76000-memory.dmp

    Filesize

    792KB

  • memory/4552-22-0x0000000006DB0000-0x0000000006E76000-memory.dmp

    Filesize

    792KB

  • memory/4552-20-0x0000000006DB0000-0x0000000006E76000-memory.dmp

    Filesize

    792KB

  • memory/4552-18-0x0000000006DB0000-0x0000000006E76000-memory.dmp

    Filesize

    792KB

  • memory/4552-16-0x0000000006DB0000-0x0000000006E76000-memory.dmp

    Filesize

    792KB

  • memory/4552-14-0x0000000006DB0000-0x0000000006E76000-memory.dmp

    Filesize

    792KB

  • memory/4552-12-0x0000000006DB0000-0x0000000006E76000-memory.dmp

    Filesize

    792KB

  • memory/4552-10-0x0000000006DB0000-0x0000000006E76000-memory.dmp

    Filesize

    792KB

  • memory/4552-66-0x0000000006DB0000-0x0000000006E76000-memory.dmp

    Filesize

    792KB

  • memory/4552-2053-0x0000000007750000-0x00000000077E2000-memory.dmp

    Filesize

    584KB

  • memory/4552-2054-0x0000000007810000-0x0000000007832000-memory.dmp

    Filesize

    136KB

  • memory/4552-2055-0x0000000007A60000-0x0000000007DB4000-memory.dmp

    Filesize

    3.3MB

  • memory/4552-68-0x0000000006DB0000-0x0000000006E76000-memory.dmp

    Filesize

    792KB

  • memory/4552-70-0x0000000006DB0000-0x0000000006E76000-memory.dmp

    Filesize

    792KB

  • memory/4552-72-0x0000000006DB0000-0x0000000006E76000-memory.dmp

    Filesize

    792KB

  • memory/4552-58-0x0000000006DB0000-0x0000000006E76000-memory.dmp

    Filesize

    792KB

  • memory/4552-56-0x0000000006DB0000-0x0000000006E76000-memory.dmp

    Filesize

    792KB

  • memory/4552-32-0x0000000006DB0000-0x0000000006E76000-memory.dmp

    Filesize

    792KB

  • memory/4552-8-0x00000000074D0000-0x0000000007582000-memory.dmp

    Filesize

    712KB

  • memory/4552-7-0x0000000007190000-0x00000000071E0000-memory.dmp

    Filesize

    320KB

  • memory/4552-6-0x0000000006DB0000-0x0000000006E7C000-memory.dmp

    Filesize

    816KB

  • memory/4552-5-0x0000000005660000-0x000000000566A000-memory.dmp

    Filesize

    40KB

  • memory/4552-4-0x00000000056E0000-0x0000000005772000-memory.dmp

    Filesize

    584KB

  • memory/4552-2075-0x00000000743FE000-0x00000000743FF000-memory.dmp

    Filesize

    4KB

  • memory/4552-2076-0x00000000743F0000-0x0000000074BA0000-memory.dmp

    Filesize

    7.7MB

  • memory/4552-3-0x00000000743F0000-0x0000000074BA0000-memory.dmp

    Filesize

    7.7MB

  • memory/4552-2-0x0000000005C90000-0x0000000006234000-memory.dmp

    Filesize

    5.6MB

  • memory/4552-2087-0x00000000743F0000-0x0000000074BA0000-memory.dmp

    Filesize

    7.7MB

  • memory/4552-1-0x0000000000AA0000-0x0000000000C3E000-memory.dmp

    Filesize

    1.6MB

  • memory/5848-2086-0x00000000743F0000-0x0000000074BA0000-memory.dmp

    Filesize

    7.7MB

  • memory/5848-2085-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/5848-2088-0x0000000006440000-0x0000000006A58000-memory.dmp

    Filesize

    6.1MB

  • memory/5848-2089-0x0000000007CC0000-0x0000000007DCA000-memory.dmp

    Filesize

    1.0MB

  • memory/5848-2090-0x00000000063C0000-0x00000000063D2000-memory.dmp

    Filesize

    72KB

  • memory/5848-2091-0x0000000007E90000-0x0000000007ECC000-memory.dmp

    Filesize

    240KB

  • memory/5848-2092-0x0000000007ED0000-0x0000000007F1C000-memory.dmp

    Filesize

    304KB

  • memory/5848-2093-0x00000000743F0000-0x0000000074BA0000-memory.dmp

    Filesize

    7.7MB