Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-01-2025 01:04

General

  • Target

    JaffaCakes118_694c250454d428235562b4b4b11a431c.exe

  • Size

    156KB

  • MD5

    694c250454d428235562b4b4b11a431c

  • SHA1

    714aeb91f3a7fe25925e1ae5d62031e34314c8a7

  • SHA256

    a6794c613a8c04404efcebce43ec1a6b44d25ac991b68183b32d4a1379d59b0a

  • SHA512

    c84b7b58ed3f47f5220c3dbb04500de29bd32ddc54f5cf85fa741a1f9ec30b56476fec033f750bbeb9624866b41b2071a79fd06b73b55cb80afc7160728d18dc

  • SSDEEP

    3072:jKX/y3KX20bPwlP4fNMVncHQi2KK4EnEH+36kGfHvuCUXdl:eXO90bwl8NM1cHF2Ki365PvuF

Malware Config

Extracted

Family

redline

C2

141.94.188.138:46419

Attributes
  • auth_value

    3f48b95855158031ae9e7dafcb203009

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Redline family
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 1 IoCs
  • Sectoprat family
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_694c250454d428235562b4b4b11a431c.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_694c250454d428235562b4b4b11a431c.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3088
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      #cmd
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1440

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1440-7-0x00000000054A0000-0x0000000005AB8000-memory.dmp

    Filesize

    6.1MB

  • memory/1440-9-0x0000000005020000-0x000000000512A000-memory.dmp

    Filesize

    1.0MB

  • memory/1440-14-0x0000000074400000-0x0000000074BB0000-memory.dmp

    Filesize

    7.7MB

  • memory/1440-3-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

  • memory/1440-8-0x0000000004EB0000-0x0000000004EC2000-memory.dmp

    Filesize

    72KB

  • memory/1440-6-0x000000007440E000-0x000000007440F000-memory.dmp

    Filesize

    4KB

  • memory/1440-13-0x000000007440E000-0x000000007440F000-memory.dmp

    Filesize

    4KB

  • memory/1440-12-0x0000000004F90000-0x0000000004FDC000-memory.dmp

    Filesize

    304KB

  • memory/1440-11-0x0000000074400000-0x0000000074BB0000-memory.dmp

    Filesize

    7.7MB

  • memory/1440-10-0x0000000004F50000-0x0000000004F8C000-memory.dmp

    Filesize

    240KB

  • memory/3088-5-0x00007FFF96F50000-0x00007FFF97A11000-memory.dmp

    Filesize

    10.8MB

  • memory/3088-0-0x00007FFF96F53000-0x00007FFF96F55000-memory.dmp

    Filesize

    8KB

  • memory/3088-1-0x0000000000410000-0x000000000043A000-memory.dmp

    Filesize

    168KB

  • memory/3088-2-0x00007FFF96F50000-0x00007FFF97A11000-memory.dmp

    Filesize

    10.8MB