Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
31-12-2024 01:58
General
-
Target
JaffaCakes118_00521f269650587e7a0cc78b409ead6a.exe
-
Size
428KB
-
MD5
00521f269650587e7a0cc78b409ead6a
-
SHA1
2792a893facb52fca484332b5f64616bc9cd8d13
-
SHA256
b2dfc34306657e5b4489e4d0332d0786bf8955c53205ba5f1be134294a8b6000
-
SHA512
3fdea08632c7d64bfb73b5372714463338bff575180a4603cd56f16daa906019502ada7f119fa16ba58baaed1b3a671d73e14531dd7228b8aa5031801bfa2292
-
SSDEEP
6144:73OdxZnGE5hf7ghOpfij6fOr0p0NJMgTFt8BEZv9T+Pcccc9SX:73OdxZ58hKqj6O/MgTFtjZv96PccccgX
Score
10/10
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
-
Redline family
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_00521f269650587e7a0cc78b409ead6a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_00521f269650587e7a0cc78b409ead6a.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4240 -s 11482⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4240 -ip 42401⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
256KB
-
Filesize
268KB
-
Filesize
280KB
-
Filesize
18.9MB
-
Filesize
272KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
1024KB
-
Filesize
18.9MB
-
Filesize
268KB
-
Filesize
256KB