redline | 9f580138414c874e3c6bb76734b28c78712cf87dfac21fb52c7f574c03836a3a

Analysis

max time kernel
1s
max time network
39s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
28-12-2024 22:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_9f580138414c874e3c6bb76734b28c78712cf87dfac21fb52c7f574c03836a3a.exe
Size

929.0MB
MD5

215b9c33f7c152c1081fb52e0fa61408
SHA1

d5953827cc8ac930873878fbbe602ae74d2034db
SHA256

9f580138414c874e3c6bb76734b28c78712cf87dfac21fb52c7f574c03836a3a
SHA512

a6489ecbd1fb6d684957941435f3e55dcefdd4fe189b29aaf2c6d417162728960e756dbcf5c6007361996e341a9596ccbcf2be072f68db45d8eea35d7953082e
SSDEEP

25165824:cnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnf:cnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnf

Score

10^/10

redline infostealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Redline family
redline

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1876	JaffaCakes118_9f580138414c874e3c6bb76734b28c78712cf87dfac21fb52c7f574c03836a3a.exe
1876	JaffaCakes118_9f580138414c874e3c6bb76734b28c78712cf87dfac21fb52c7f574c03836a3a.exe
1876	JaffaCakes118_9f580138414c874e3c6bb76734b28c78712cf87dfac21fb52c7f574c03836a3a.exe
1876	JaffaCakes118_9f580138414c874e3c6bb76734b28c78712cf87dfac21fb52c7f574c03836a3a.exe
1876	JaffaCakes118_9f580138414c874e3c6bb76734b28c78712cf87dfac21fb52c7f574c03836a3a.exe
1876	JaffaCakes118_9f580138414c874e3c6bb76734b28c78712cf87dfac21fb52c7f574c03836a3a.exe
1876	JaffaCakes118_9f580138414c874e3c6bb76734b28c78712cf87dfac21fb52c7f574c03836a3a.exe
1876	JaffaCakes118_9f580138414c874e3c6bb76734b28c78712cf87dfac21fb52c7f574c03836a3a.exe
1876	JaffaCakes118_9f580138414c874e3c6bb76734b28c78712cf87dfac21fb52c7f574c03836a3a.exe
1876	JaffaCakes118_9f580138414c874e3c6bb76734b28c78712cf87dfac21fb52c7f574c03836a3a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1876	JaffaCakes118_9f580138414c874e3c6bb76734b28c78712cf87dfac21fb52c7f574c03836a3a.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 2304	1876	JaffaCakes118_9f580138414c874e3c6bb76734b28c78712cf87dfac21fb52c7f574c03836a3a.exe	32
PID 1876 wrote to memory of 2304	1876	JaffaCakes118_9f580138414c874e3c6bb76734b28c78712cf87dfac21fb52c7f574c03836a3a.exe	32
PID 1876 wrote to memory of 2304	1876	JaffaCakes118_9f580138414c874e3c6bb76734b28c78712cf87dfac21fb52c7f574c03836a3a.exe	32
PID 1876 wrote to memory of 2304	1876	JaffaCakes118_9f580138414c874e3c6bb76734b28c78712cf87dfac21fb52c7f574c03836a3a.exe	32
PID 1876 wrote to memory of 776	1876	JaffaCakes118_9f580138414c874e3c6bb76734b28c78712cf87dfac21fb52c7f574c03836a3a.exe	33
PID 1876 wrote to memory of 776	1876	JaffaCakes118_9f580138414c874e3c6bb76734b28c78712cf87dfac21fb52c7f574c03836a3a.exe	33
PID 1876 wrote to memory of 776	1876	JaffaCakes118_9f580138414c874e3c6bb76734b28c78712cf87dfac21fb52c7f574c03836a3a.exe	33
PID 1876 wrote to memory of 776	1876	JaffaCakes118_9f580138414c874e3c6bb76734b28c78712cf87dfac21fb52c7f574c03836a3a.exe	33
PID 1876 wrote to memory of 1164	1876	JaffaCakes118_9f580138414c874e3c6bb76734b28c78712cf87dfac21fb52c7f574c03836a3a.exe	34
PID 1876 wrote to memory of 1164	1876	JaffaCakes118_9f580138414c874e3c6bb76734b28c78712cf87dfac21fb52c7f574c03836a3a.exe	34
PID 1876 wrote to memory of 1164	1876	JaffaCakes118_9f580138414c874e3c6bb76734b28c78712cf87dfac21fb52c7f574c03836a3a.exe	34
PID 1876 wrote to memory of 1164	1876	JaffaCakes118_9f580138414c874e3c6bb76734b28c78712cf87dfac21fb52c7f574c03836a3a.exe	34
PID 1876 wrote to memory of 336	1876	JaffaCakes118_9f580138414c874e3c6bb76734b28c78712cf87dfac21fb52c7f574c03836a3a.exe	35
PID 1876 wrote to memory of 336	1876	JaffaCakes118_9f580138414c874e3c6bb76734b28c78712cf87dfac21fb52c7f574c03836a3a.exe	35
PID 1876 wrote to memory of 336	1876	JaffaCakes118_9f580138414c874e3c6bb76734b28c78712cf87dfac21fb52c7f574c03836a3a.exe	35
PID 1876 wrote to memory of 336	1876	JaffaCakes118_9f580138414c874e3c6bb76734b28c78712cf87dfac21fb52c7f574c03836a3a.exe	35
PID 1876 wrote to memory of 1688	1876	JaffaCakes118_9f580138414c874e3c6bb76734b28c78712cf87dfac21fb52c7f574c03836a3a.exe	36
PID 1876 wrote to memory of 1688	1876	JaffaCakes118_9f580138414c874e3c6bb76734b28c78712cf87dfac21fb52c7f574c03836a3a.exe	36
PID 1876 wrote to memory of 1688	1876	JaffaCakes118_9f580138414c874e3c6bb76734b28c78712cf87dfac21fb52c7f574c03836a3a.exe	36
PID 1876 wrote to memory of 1688	1876	JaffaCakes118_9f580138414c874e3c6bb76734b28c78712cf87dfac21fb52c7f574c03836a3a.exe	36

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9f580138414c874e3c6bb76734b28c78712cf87dfac21fb52c7f574c03836a3a.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9f580138414c874e3c6bb76734b28c78712cf87dfac21fb52c7f574c03836a3a.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:2304
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:776
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:1164
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:336
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  PID:1688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1876-0-0x000007FEF5D93000-0x000007FEF5D94000-memory.dmp

Filesize
4KB

Download
memory/1876-1-0x00000000001E0000-0x0000000000322000-memory.dmp

Filesize
1.3MB

Download
memory/1876-2-0x000007FEF5D90000-0x000007FEF677C000-memory.dmp

Filesize
9.9MB

Download
memory/1876-3-0x000007FEF5D90000-0x000007FEF677C000-memory.dmp

Filesize
9.9MB

Download
memory/1876-4-0x0000000002080000-0x0000000002106000-memory.dmp

Filesize
536KB

Download
memory/1876-14-0x0000000002080000-0x0000000002100000-memory.dmp

Filesize
512KB

Download
memory/1876-68-0x0000000002080000-0x0000000002100000-memory.dmp

Filesize
512KB

Download
memory/1876-113-0x000007FEF5D90000-0x000007FEF677C000-memory.dmp

Filesize
9.9MB

Download
memory/1876-66-0x0000000002080000-0x0000000002100000-memory.dmp

Filesize
512KB

Download
memory/1876-64-0x0000000002080000-0x0000000002100000-memory.dmp

Filesize
512KB

Download
memory/1876-62-0x0000000002080000-0x0000000002100000-memory.dmp

Filesize
512KB

Download
memory/1876-114-0x000007FEF5D90000-0x000007FEF677C000-memory.dmp

Filesize
9.9MB

Download
memory/1876-61-0x0000000002080000-0x0000000002100000-memory.dmp

Filesize
512KB

Download
memory/1876-58-0x0000000002080000-0x0000000002100000-memory.dmp

Filesize
512KB

Download
memory/1876-56-0x0000000002080000-0x0000000002100000-memory.dmp

Filesize
512KB

Download
memory/1876-54-0x0000000002080000-0x0000000002100000-memory.dmp

Filesize
512KB

Download
memory/1876-52-0x0000000002080000-0x0000000002100000-memory.dmp

Filesize
512KB

Download
memory/1876-51-0x0000000002080000-0x0000000002100000-memory.dmp

Filesize
512KB

Download
memory/1876-48-0x0000000002080000-0x0000000002100000-memory.dmp

Filesize
512KB

Download
memory/1876-46-0x0000000002080000-0x0000000002100000-memory.dmp

Filesize
512KB

Download
memory/1876-44-0x0000000002080000-0x0000000002100000-memory.dmp

Filesize
512KB

Download
memory/1876-42-0x0000000002080000-0x0000000002100000-memory.dmp

Filesize
512KB

Download
memory/1876-40-0x0000000002080000-0x0000000002100000-memory.dmp

Filesize
512KB

Download
memory/1876-38-0x0000000002080000-0x0000000002100000-memory.dmp

Filesize
512KB

Download
memory/1876-36-0x0000000002080000-0x0000000002100000-memory.dmp

Filesize
512KB

Download
memory/1876-34-0x0000000002080000-0x0000000002100000-memory.dmp

Filesize
512KB

Download
memory/1876-32-0x0000000002080000-0x0000000002100000-memory.dmp

Filesize
512KB

Download
memory/1876-30-0x0000000002080000-0x0000000002100000-memory.dmp

Filesize
512KB

Download
memory/1876-29-0x0000000002080000-0x0000000002100000-memory.dmp

Filesize
512KB

Download
memory/1876-26-0x0000000002080000-0x0000000002100000-memory.dmp

Filesize
512KB

Download
memory/1876-25-0x0000000002080000-0x0000000002100000-memory.dmp

Filesize
512KB

Download
memory/1876-22-0x0000000002080000-0x0000000002100000-memory.dmp

Filesize
512KB

Download
memory/1876-20-0x0000000002080000-0x0000000002100000-memory.dmp

Filesize
512KB

Download
memory/1876-18-0x0000000002080000-0x0000000002100000-memory.dmp

Filesize
512KB

Download
memory/1876-16-0x0000000002080000-0x0000000002100000-memory.dmp

Filesize
512KB

Download
memory/1876-12-0x0000000002080000-0x0000000002100000-memory.dmp

Filesize
512KB

Download
memory/1876-10-0x0000000002080000-0x0000000002100000-memory.dmp

Filesize
512KB

Download
memory/1876-8-0x0000000002080000-0x0000000002100000-memory.dmp

Filesize
512KB

Download
memory/1876-6-0x0000000002080000-0x0000000002100000-memory.dmp

Filesize
512KB

Download
memory/1876-5-0x0000000002080000-0x0000000002100000-memory.dmp

Filesize
512KB

Download