Analysis

  • max time kernel
    140s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    31-12-2024 16:30

General

  • Target

    JaffaCakes118_2858beeeb9db9aa3e1f9d2810e33638b.exe

  • Size

    767KB

  • MD5

    2858beeeb9db9aa3e1f9d2810e33638b

  • SHA1

    c183c1e6c81fdcaa69ec19e86f109ef4bb02ce40

  • SHA256

    b9f13f19be282375cd4860dd2f0f746fde7f203ad4d2826e92662616a2f6a031

  • SHA512

    2a21241b22d222992a19f68079f56b0669a7cda047cf86b6d5bb7b78cc5f50f87c5e45c68d055d113042838397874b4e6a8b501d6b646e50a15e8fae03583e8a

  • SSDEEP

    12288:34EveCmCSUJ3IKTKkhETZIDuM0i2hn2HMqGduCci01YycP7GXd2jVr:34EvGCdDurm5G0C/0bcPeKr

Malware Config

Extracted

Family

redline

Botnet

@tupa187

C2

95.181.152.5:46927

Attributes
  • auth_value

    cdf3919a262c0d6ba99116b375d7551c

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Redline family
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 5 IoCs
  • Sectoprat family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2858beeeb9db9aa3e1f9d2810e33638b.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2858beeeb9db9aa3e1f9d2810e33638b.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2688

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2688-0-0x00000000003F0000-0x0000000000421000-memory.dmp

    Filesize

    196KB

  • memory/2688-7-0x00000000003F0000-0x0000000000421000-memory.dmp

    Filesize

    196KB

  • memory/2688-8-0x000000007475E000-0x000000007475F000-memory.dmp

    Filesize

    4KB

  • memory/2688-9-0x0000000000660000-0x0000000000682000-memory.dmp

    Filesize

    136KB

  • memory/2688-10-0x0000000000660000-0x0000000000682000-memory.dmp

    Filesize

    136KB

  • memory/2688-11-0x0000000074750000-0x0000000074E3E000-memory.dmp

    Filesize

    6.9MB

  • memory/2688-12-0x0000000074750000-0x0000000074E3E000-memory.dmp

    Filesize

    6.9MB

  • memory/2688-13-0x00000000003F0000-0x0000000000421000-memory.dmp

    Filesize

    196KB

  • memory/2688-14-0x000000007475E000-0x000000007475F000-memory.dmp

    Filesize

    4KB

  • memory/2688-15-0x0000000074750000-0x0000000074E3E000-memory.dmp

    Filesize

    6.9MB

  • memory/2688-16-0x0000000000500000-0x00000000005C6000-memory.dmp

    Filesize

    792KB