redline | 00cd272476489e41fb7f6a4ccaa0b6e4b922c23033b2dc5bfdb79a13da43a850

Analysis

max time kernel
144s
max time network
140s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
01/01/2025, 10:09 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_50fd094675da74aa0e5b9a298bfa783d.exe
Size

1.1MB
MD5

50fd094675da74aa0e5b9a298bfa783d
SHA1

66e6cf05dc34a5c47a61ca376a17db34f0c7d784
SHA256

00cd272476489e41fb7f6a4ccaa0b6e4b922c23033b2dc5bfdb79a13da43a850
SHA512

f6412417aaaff269cd2dddd08cfc43ebc6281731d1995779706b396105bb08f449cc1ff8947323bcdcaa6c3e5611579fbd1eab65661adf6c2ddc5d0bb9b9daad
SSDEEP

24576:Vgl9ZWtVJbYeE1qeVqtuFPb+8lFTRURAr1FuYDHhTi2pTHaYxLQQU:VgdW5b1AzQgPVvFUKSYLBppxLHU

Score

10^/10

redline sectoprat @xxluchxx1 discovery infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

@xxluchxx1

185.209.22.181:34925

Attributes

auth_value
5a0918bd3e8ede8e02c8dd9d106a996d

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Redline family
redline
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/1028-2-0x0000000000950000-0x0000000000CEE000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat

Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs

pid	Process
1028	JaffaCakes118_50fd094675da74aa0e5b9a298bfa783d.exe
1028	JaffaCakes118_50fd094675da74aa0e5b9a298bfa783d.exe
1028	JaffaCakes118_50fd094675da74aa0e5b9a298bfa783d.exe
1028	JaffaCakes118_50fd094675da74aa0e5b9a298bfa783d.exe
1028	JaffaCakes118_50fd094675da74aa0e5b9a298bfa783d.exe
1028	JaffaCakes118_50fd094675da74aa0e5b9a298bfa783d.exe
1028	JaffaCakes118_50fd094675da74aa0e5b9a298bfa783d.exe
1028	JaffaCakes118_50fd094675da74aa0e5b9a298bfa783d.exe
1028	JaffaCakes118_50fd094675da74aa0e5b9a298bfa783d.exe
1028	JaffaCakes118_50fd094675da74aa0e5b9a298bfa783d.exe
1028	JaffaCakes118_50fd094675da74aa0e5b9a298bfa783d.exe
1028	JaffaCakes118_50fd094675da74aa0e5b9a298bfa783d.exe
1028	JaffaCakes118_50fd094675da74aa0e5b9a298bfa783d.exe
1028	JaffaCakes118_50fd094675da74aa0e5b9a298bfa783d.exe
1028	JaffaCakes118_50fd094675da74aa0e5b9a298bfa783d.exe
1028	JaffaCakes118_50fd094675da74aa0e5b9a298bfa783d.exe
1028	JaffaCakes118_50fd094675da74aa0e5b9a298bfa783d.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_50fd094675da74aa0e5b9a298bfa783d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1028	JaffaCakes118_50fd094675da74aa0e5b9a298bfa783d.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_50fd094675da74aa0e5b9a298bfa783d.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_50fd094675da74aa0e5b9a298bfa783d.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1028

Network

No results found

185.209.22.181:34925

JaffaCakes118_50fd094675da74aa0e5b9a298bfa783d.exe

152 B
3
185.209.22.181:34925

JaffaCakes118_50fd094675da74aa0e5b9a298bfa783d.exe

152 B
3
185.209.22.181:34925

JaffaCakes118_50fd094675da74aa0e5b9a298bfa783d.exe

152 B
3
185.209.22.181:34925

JaffaCakes118_50fd094675da74aa0e5b9a298bfa783d.exe

152 B
3
185.209.22.181:34925

JaffaCakes118_50fd094675da74aa0e5b9a298bfa783d.exe

152 B
3
185.209.22.181:34925

JaffaCakes118_50fd094675da74aa0e5b9a298bfa783d.exe

152 B
3

No results found

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1028-0-0x0000000000950000-0x0000000000CEE000-memory.dmp

Filesize
3.6MB

Download
memory/1028-1-0x0000000073EFE000-0x0000000073EFF000-memory.dmp

Filesize
4KB

Download
memory/1028-2-0x0000000000950000-0x0000000000CEE000-memory.dmp

Filesize
3.6MB

Download
memory/1028-3-0x0000000073EF0000-0x00000000745DE000-memory.dmp

Filesize
6.9MB

Download
memory/1028-4-0x0000000000950000-0x0000000000CEE000-memory.dmp

Filesize
3.6MB

Download
memory/1028-5-0x0000000073EFE000-0x0000000073EFF000-memory.dmp

Filesize
4KB

Download
memory/1028-7-0x0000000073EF0000-0x00000000745DE000-memory.dmp

Filesize
6.9MB

Download