redline | 3e6e9b73ff7fbe58dfc2b7bdf8c8af6cf1fcd80dfedd50e0f6bf9d6aa11a87ee

Analysis

max time kernel
144s
max time network
152s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
08-01-2025 02:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_869c98fc53aa5f11e75ffa2744381995.exe
Size

1.1MB
MD5

869c98fc53aa5f11e75ffa2744381995
SHA1

16372b3dba63c8725158487c81d3c620d82585e4
SHA256

3e6e9b73ff7fbe58dfc2b7bdf8c8af6cf1fcd80dfedd50e0f6bf9d6aa11a87ee
SHA512

8320ece8ded0e2cb2b7936df77b03dd97d54f3849b44d46932d4141b51041e5c2cf2a03f02843db9c2e7e5f109e61431886fe275040e137b68a2dfb029313cc6
SSDEEP

12288:4+wJ9GeeYwTVlCOCQWAKeAaf/+YQZ7QQ6m1N4LWgViFd1kXanGJAWCG2GBKf/OJv:9eZ7YymWgpkM4

Score

10^/10

redline sectoprat @a0867183086d949f0c153b3bbcf46510 discovery infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

@a0867183086d949f0c153b3bbcf46510

212.86.102.118:22117

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/2204-7-0x00000000007A0000-0x00000000007BE000-memory.dmp	family_redline

Redline family
redline
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/2204-7-0x00000000007A0000-0x00000000007BE000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_869c98fc53aa5f11e75ffa2744381995.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2200	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2200	powershell.exe
Token: SeDebugPrivilege	2204	JaffaCakes118_869c98fc53aa5f11e75ffa2744381995.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2200	2204	JaffaCakes118_869c98fc53aa5f11e75ffa2744381995.exe	30
PID 2204 wrote to memory of 2200	2204	JaffaCakes118_869c98fc53aa5f11e75ffa2744381995.exe	30
PID 2204 wrote to memory of 2200	2204	JaffaCakes118_869c98fc53aa5f11e75ffa2744381995.exe	30
PID 2204 wrote to memory of 2200	2204	JaffaCakes118_869c98fc53aa5f11e75ffa2744381995.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_869c98fc53aa5f11e75ffa2744381995.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_869c98fc53aa5f11e75ffa2744381995.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMgAwAA==
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2200-5-0x0000000002740000-0x0000000002780000-memory.dmp

Filesize
256KB

Download
memory/2200-6-0x0000000002740000-0x0000000002780000-memory.dmp

Filesize
256KB

Download
memory/2204-0-0x0000000074C6E000-0x0000000074C6F000-memory.dmp

Filesize
4KB

Download
memory/2204-1-0x0000000001160000-0x000000000128A000-memory.dmp

Filesize
1.2MB

Download
memory/2204-2-0x0000000074C6E000-0x0000000074C6F000-memory.dmp

Filesize
4KB

Download
memory/2204-7-0x00000000007A0000-0x00000000007BE000-memory.dmp

Filesize
120KB

Download