Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-01-2025 10:41

General

  • Target

    JaffaCakes118_9b4b76fc942b94f80abd4e8893443d37.exe

  • Size

    4.6MB

  • MD5

    9b4b76fc942b94f80abd4e8893443d37

  • SHA1

    e152fb08c25519d0e27977c57ca131cc4203600f

  • SHA256

    286f6ea3d502363b6bfde4f73aa50f75a6569158b9b4a920414adee1b8dae164

  • SHA512

    049c1a27fe61f515145fec9887c1bce6077973423abc5e80588a81acf38927de147ad6de1feb9424622f09c235f11d65e691951c35a90f67a20165b86eb68af8

  • SSDEEP

    98304:4LmDXxsBZXpB6J5K1LoZkc2O8dzTDw5fWQ3dn8U3JJ9BL:luBtuJOoLVorwNWQ3dn8U3vjL

Malware Config

Extracted

Family

redline

Botnet

@dalbaeb2228

C2

190.2.136.29:15554

Attributes
  • auth_value

    c3619bd2b5611a61169719e72acd942d

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Redline family
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9b4b76fc942b94f80abd4e8893443d37.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9b4b76fc942b94f80abd4e8893443d37.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3552
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1364
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 272
      2⤵
      • Program crash
      PID:212
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3552 -ip 3552
    1⤵
      PID:1128

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1364-20-0x0000000074D50000-0x0000000075500000-memory.dmp

      Filesize

      7.7MB

    • memory/1364-16-0x0000000005480000-0x0000000005A98000-memory.dmp

      Filesize

      6.1MB

    • memory/1364-9-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/1364-23-0x0000000074D5E000-0x0000000074D5F000-memory.dmp

      Filesize

      4KB

    • memory/1364-21-0x0000000004F00000-0x0000000004F4C000-memory.dmp

      Filesize

      304KB

    • memory/1364-19-0x0000000004EC0000-0x0000000004EFC000-memory.dmp

      Filesize

      240KB

    • memory/1364-18-0x0000000004F90000-0x000000000509A000-memory.dmp

      Filesize

      1.0MB

    • memory/1364-15-0x0000000074D5E000-0x0000000074D5F000-memory.dmp

      Filesize

      4KB

    • memory/1364-24-0x0000000074D50000-0x0000000075500000-memory.dmp

      Filesize

      7.7MB

    • memory/1364-17-0x0000000004E60000-0x0000000004E72000-memory.dmp

      Filesize

      72KB

    • memory/3552-5-0x0000000003240000-0x0000000003241000-memory.dmp

      Filesize

      4KB

    • memory/3552-2-0x0000000003210000-0x0000000003211000-memory.dmp

      Filesize

      4KB

    • memory/3552-22-0x0000000000D65000-0x0000000000FDC000-memory.dmp

      Filesize

      2.5MB

    • memory/3552-4-0x0000000003230000-0x0000000003231000-memory.dmp

      Filesize

      4KB

    • memory/3552-0-0x00000000031D0000-0x00000000031D1000-memory.dmp

      Filesize

      4KB

    • memory/3552-1-0x00000000031E0000-0x00000000031E1000-memory.dmp

      Filesize

      4KB

    • memory/3552-7-0x0000000000D30000-0x00000000011C3000-memory.dmp

      Filesize

      4.6MB

    • memory/3552-14-0x0000000000D30000-0x00000000011C3000-memory.dmp

      Filesize

      4.6MB

    • memory/3552-6-0x0000000000D65000-0x0000000000FDC000-memory.dmp

      Filesize

      2.5MB

    • memory/3552-3-0x0000000003220000-0x0000000003221000-memory.dmp

      Filesize

      4KB