Analysis
-
max time kernel
93s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
05-01-2025 19:10
General
-
Target
JaffaCakes118_b8a369d265cd23467b9873688b3104ac.exe
-
Size
370KB
-
MD5
b8a369d265cd23467b9873688b3104ac
-
SHA1
d41dfa317055b69706670c10aab3c543cba37c19
-
SHA256
3cdb16759771b941d4bfe5c2a5fad94dd5011fb4df508f6b5381cdf057150fd8
-
SHA512
f8e229d8fb2e5cb4753cace05c44f19feae934daef7d1bd9710ecf477f35c2584d6db65299cd8ec7977a30fd55585ddfb91cb496f0866610e8c19a8b425e0119
-
SSDEEP
6144:fjTwecc1ywUUIpjd670dSa0Smg1Q0ekE+jUMCGOgGBsYbVx98aC32kw+2r:b8eNUw8pjd6Q4a0tiFekHYC+H8no+G
Score
10/10
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
-
Redline family
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b8a369d265cd23467b9873688b3104ac.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b8a369d265cd23467b9873688b3104ac.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 11602⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3636 -ip 36361⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
256KB
-
Filesize
268KB
-
Filesize
828KB
-
Filesize
280KB
-
Filesize
5.6MB
-
Filesize
272KB
-
Filesize
584KB
-
Filesize
1024KB
-
Filesize
256KB
-
Filesize
268KB
-
Filesize
828KB
-
Filesize
268KB