redline | c93af8d94c03adaf209946a1d98e54620a9392199ff677fc32a3c0e32b9e70ce

Analysis

max time kernel
4s
max time network
67s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
24-12-2024 14:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_c93af8d94c03adaf209946a1d98e54620a9392199ff677fc32a3c0e32b9e70ce.exe
Size

930.0MB
MD5

3ad9cd498f060013a18c40a8cad0d445
SHA1

969aaa9e855d9340460f25ece9ffa6bd3864608a
SHA256

c93af8d94c03adaf209946a1d98e54620a9392199ff677fc32a3c0e32b9e70ce
SHA512

6ee4c67fe6a76d5bb20d08afb064ee266649b3213332b83943b491024f8fc86f73b9edd1eb29cd347afa6c030a0ee08a07a916eee347ad69755120e996cc3355
SSDEEP

25165824:Cnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnf:Cnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnf

Score

10^/10

redline infostealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Redline family
redline

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2304	JaffaCakes118_c93af8d94c03adaf209946a1d98e54620a9392199ff677fc32a3c0e32b9e70ce.exe
2304	JaffaCakes118_c93af8d94c03adaf209946a1d98e54620a9392199ff677fc32a3c0e32b9e70ce.exe
2304	JaffaCakes118_c93af8d94c03adaf209946a1d98e54620a9392199ff677fc32a3c0e32b9e70ce.exe
2304	JaffaCakes118_c93af8d94c03adaf209946a1d98e54620a9392199ff677fc32a3c0e32b9e70ce.exe
2304	JaffaCakes118_c93af8d94c03adaf209946a1d98e54620a9392199ff677fc32a3c0e32b9e70ce.exe
2304	JaffaCakes118_c93af8d94c03adaf209946a1d98e54620a9392199ff677fc32a3c0e32b9e70ce.exe
2304	JaffaCakes118_c93af8d94c03adaf209946a1d98e54620a9392199ff677fc32a3c0e32b9e70ce.exe
2304	JaffaCakes118_c93af8d94c03adaf209946a1d98e54620a9392199ff677fc32a3c0e32b9e70ce.exe
2304	JaffaCakes118_c93af8d94c03adaf209946a1d98e54620a9392199ff677fc32a3c0e32b9e70ce.exe
2304	JaffaCakes118_c93af8d94c03adaf209946a1d98e54620a9392199ff677fc32a3c0e32b9e70ce.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2304	JaffaCakes118_c93af8d94c03adaf209946a1d98e54620a9392199ff677fc32a3c0e32b9e70ce.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 1872	2304	JaffaCakes118_c93af8d94c03adaf209946a1d98e54620a9392199ff677fc32a3c0e32b9e70ce.exe	32
PID 2304 wrote to memory of 1872	2304	JaffaCakes118_c93af8d94c03adaf209946a1d98e54620a9392199ff677fc32a3c0e32b9e70ce.exe	32
PID 2304 wrote to memory of 1872	2304	JaffaCakes118_c93af8d94c03adaf209946a1d98e54620a9392199ff677fc32a3c0e32b9e70ce.exe	32
PID 2304 wrote to memory of 1872	2304	JaffaCakes118_c93af8d94c03adaf209946a1d98e54620a9392199ff677fc32a3c0e32b9e70ce.exe	32
PID 2304 wrote to memory of 1936	2304	JaffaCakes118_c93af8d94c03adaf209946a1d98e54620a9392199ff677fc32a3c0e32b9e70ce.exe	33
PID 2304 wrote to memory of 1936	2304	JaffaCakes118_c93af8d94c03adaf209946a1d98e54620a9392199ff677fc32a3c0e32b9e70ce.exe	33
PID 2304 wrote to memory of 1936	2304	JaffaCakes118_c93af8d94c03adaf209946a1d98e54620a9392199ff677fc32a3c0e32b9e70ce.exe	33
PID 2304 wrote to memory of 1936	2304	JaffaCakes118_c93af8d94c03adaf209946a1d98e54620a9392199ff677fc32a3c0e32b9e70ce.exe	33
PID 2304 wrote to memory of 3016	2304	JaffaCakes118_c93af8d94c03adaf209946a1d98e54620a9392199ff677fc32a3c0e32b9e70ce.exe	34
PID 2304 wrote to memory of 3016	2304	JaffaCakes118_c93af8d94c03adaf209946a1d98e54620a9392199ff677fc32a3c0e32b9e70ce.exe	34
PID 2304 wrote to memory of 3016	2304	JaffaCakes118_c93af8d94c03adaf209946a1d98e54620a9392199ff677fc32a3c0e32b9e70ce.exe	34
PID 2304 wrote to memory of 3016	2304	JaffaCakes118_c93af8d94c03adaf209946a1d98e54620a9392199ff677fc32a3c0e32b9e70ce.exe	34
PID 2304 wrote to memory of 2708	2304	JaffaCakes118_c93af8d94c03adaf209946a1d98e54620a9392199ff677fc32a3c0e32b9e70ce.exe	35
PID 2304 wrote to memory of 2708	2304	JaffaCakes118_c93af8d94c03adaf209946a1d98e54620a9392199ff677fc32a3c0e32b9e70ce.exe	35
PID 2304 wrote to memory of 2708	2304	JaffaCakes118_c93af8d94c03adaf209946a1d98e54620a9392199ff677fc32a3c0e32b9e70ce.exe	35
PID 2304 wrote to memory of 2708	2304	JaffaCakes118_c93af8d94c03adaf209946a1d98e54620a9392199ff677fc32a3c0e32b9e70ce.exe	35
PID 2304 wrote to memory of 2976	2304	JaffaCakes118_c93af8d94c03adaf209946a1d98e54620a9392199ff677fc32a3c0e32b9e70ce.exe	36
PID 2304 wrote to memory of 2976	2304	JaffaCakes118_c93af8d94c03adaf209946a1d98e54620a9392199ff677fc32a3c0e32b9e70ce.exe	36
PID 2304 wrote to memory of 2976	2304	JaffaCakes118_c93af8d94c03adaf209946a1d98e54620a9392199ff677fc32a3c0e32b9e70ce.exe	36
PID 2304 wrote to memory of 2976	2304	JaffaCakes118_c93af8d94c03adaf209946a1d98e54620a9392199ff677fc32a3c0e32b9e70ce.exe	36

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c93af8d94c03adaf209946a1d98e54620a9392199ff677fc32a3c0e32b9e70ce.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c93af8d94c03adaf209946a1d98e54620a9392199ff677fc32a3c0e32b9e70ce.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:1872
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:1936
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:3016
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2708
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2304-68-0x00000000009D0000-0x0000000000A4F000-memory.dmp

Filesize
508KB

Download
memory/2304-66-0x00000000009D0000-0x0000000000A4F000-memory.dmp

Filesize
508KB

Download
memory/2304-64-0x00000000009D0000-0x0000000000A4F000-memory.dmp

Filesize
508KB

Download
memory/2304-63-0x00000000009D0000-0x0000000000A4F000-memory.dmp

Filesize
508KB

Download
memory/2304-114-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Filesize
9.9MB

Download
memory/2304-60-0x00000000009D0000-0x0000000000A4F000-memory.dmp

Filesize
508KB

Download
memory/2304-58-0x00000000009D0000-0x0000000000A4F000-memory.dmp

Filesize
508KB

Download
memory/2304-56-0x00000000009D0000-0x0000000000A4F000-memory.dmp

Filesize
508KB

Download
memory/2304-55-0x00000000009D0000-0x0000000000A4F000-memory.dmp

Filesize
508KB

Download
memory/2304-52-0x00000000009D0000-0x0000000000A4F000-memory.dmp

Filesize
508KB

Download
memory/2304-50-0x00000000009D0000-0x0000000000A4F000-memory.dmp

Filesize
508KB

Download
memory/2304-48-0x00000000009D0000-0x0000000000A4F000-memory.dmp

Filesize
508KB

Download
memory/2304-46-0x00000000009D0000-0x0000000000A4F000-memory.dmp

Filesize
508KB

Download
memory/2304-44-0x00000000009D0000-0x0000000000A4F000-memory.dmp

Filesize
508KB

Download
memory/2304-42-0x00000000009D0000-0x0000000000A4F000-memory.dmp

Filesize
508KB

Download
memory/2304-41-0x00000000009D0000-0x0000000000A4F000-memory.dmp

Filesize
508KB

Download
memory/2304-38-0x00000000009D0000-0x0000000000A4F000-memory.dmp

Filesize
508KB

Download
memory/2304-36-0x00000000009D0000-0x0000000000A4F000-memory.dmp

Filesize
508KB

Download
memory/2304-35-0x00000000009D0000-0x0000000000A4F000-memory.dmp

Filesize
508KB

Download
memory/2304-32-0x00000000009D0000-0x0000000000A4F000-memory.dmp

Filesize
508KB

Download
memory/2304-30-0x00000000009D0000-0x0000000000A4F000-memory.dmp

Filesize
508KB

Download
memory/2304-28-0x00000000009D0000-0x0000000000A4F000-memory.dmp

Filesize
508KB

Download
memory/2304-26-0x00000000009D0000-0x0000000000A4F000-memory.dmp

Filesize
508KB

Download
memory/2304-22-0x00000000009D0000-0x0000000000A4F000-memory.dmp

Filesize
508KB

Download
memory/2304-20-0x00000000009D0000-0x0000000000A4F000-memory.dmp

Filesize
508KB

Download
memory/2304-18-0x00000000009D0000-0x0000000000A4F000-memory.dmp

Filesize
508KB

Download
memory/2304-16-0x00000000009D0000-0x0000000000A4F000-memory.dmp

Filesize
508KB

Download
memory/2304-14-0x00000000009D0000-0x0000000000A4F000-memory.dmp

Filesize
508KB

Download
memory/2304-12-0x00000000009D0000-0x0000000000A4F000-memory.dmp

Filesize
508KB

Download
memory/2304-10-0x00000000009D0000-0x0000000000A4F000-memory.dmp

Filesize
508KB

Download
memory/2304-24-0x00000000009D0000-0x0000000000A4F000-memory.dmp

Filesize
508KB

Download
memory/2304-113-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Filesize
9.9MB

Download
memory/2304-8-0x00000000009D0000-0x0000000000A4F000-memory.dmp

Filesize
508KB

Download
memory/2304-6-0x00000000009D0000-0x0000000000A4F000-memory.dmp

Filesize
508KB

Download
memory/2304-5-0x00000000009D0000-0x0000000000A4F000-memory.dmp

Filesize
508KB

Download
memory/2304-4-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Filesize
9.9MB

Download
memory/2304-3-0x00000000009D0000-0x0000000000A56000-memory.dmp

Filesize
536KB

Download
memory/2304-2-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Filesize
9.9MB

Download
memory/2304-1-0x0000000001230000-0x000000000147A000-memory.dmp

Filesize
2.3MB

Download
memory/2304-0-0x000007FEF58E3000-0x000007FEF58E4000-memory.dmp

Filesize
4KB

Download