Analysis
-
max time kernel
93s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
31-12-2024 13:32
General
-
Target
JaffaCakes118_1ecccc8f149d857f05469d3bf134e367.exe
-
Size
372KB
-
MD5
1ecccc8f149d857f05469d3bf134e367
-
SHA1
052027e8cd260a93cc35858257be0cfb868b8445
-
SHA256
e7d9d0453045b3b0333757fc48ddc781f8973b5e970aa6599ebc5ab366385280
-
SHA512
4a290f6941fcc2ea8e5be5e178b39a35e9dae453c9df4233b8ece933c6d0708b70935167912f2443a97a98b4ee2dd51e0109a5c06a4f78a64261c4aacce3c2e2
-
SSDEEP
6144:iVnRBAxSnnn5O8VkXxIZivU9COfoMzJiDCQyWVJTGQ/gVx98aC3zTN:ORBcUnFWvUUOfxoDCQVVEFH8nF
Score
10/10
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
-
Redline family
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1ecccc8f149d857f05469d3bf134e367.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1ecccc8f149d857f05469d3bf134e367.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 11442⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2764 -ip 27641⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
256KB
-
Filesize
268KB
-
Filesize
828KB
-
Filesize
280KB
-
Filesize
5.6MB
-
Filesize
272KB
-
Filesize
584KB
-
Filesize
1024KB
-
Filesize
256KB
-
Filesize
268KB
-
Filesize
828KB
-
Filesize
268KB