redline | 6de8ec31f54283d326c41d633361a19f8635d269f4cf24560b8a994657f6cb89

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-01-2025 01:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_f32f0973ac645d486efd6b0d2ba41233.exe
Size

816KB
MD5

f32f0973ac645d486efd6b0d2ba41233
SHA1

88c21dc32e3e3e0f7a180c73a67da1d33a607d7e
SHA256

6de8ec31f54283d326c41d633361a19f8635d269f4cf24560b8a994657f6cb89
SHA512

b59e81288f92e3d5114ebda96f93afb41ac286bab07736ecc3e2ba28de2979188b7014066a574e683c6fb66272bb79ec9f206a9123817793ecb62f6581507a22
SSDEEP

24576:EDWHSb4NFK9999dddddddzDdrK9999dddddddzDd/Qwb12RE85eY63ke1Fdil1rG:f84NbELEY63D1Cl1rDteSgiSV

Score

10^/10

redline @lzt2021 discovery infostealer

Malware Config

Extracted

Family

redline

Botnet

@LZT2021

95.181.152.6:46927

Attributes

auth_value
cdf3919a262c0d6ba99116b375d7551c

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

resource	yara_rule
behavioral2/memory/4600-12-0x0000000000490000-0x00000000004BE000-memory.dmp	family_redline
behavioral2/memory/4600-19-0x0000000000490000-0x00000000004BE000-memory.dmp	family_redline
behavioral2/memory/4600-21-0x00000000009A0000-0x00000000009BE000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	JaffaCakes118_f32f0973ac645d486efd6b0d2ba41233.exe

Executes dropped EXE 1 IoCs

pid	Process
4600	DQsnWZmCovBK.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_f32f0973ac645d486efd6b0d2ba41233.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DQsnWZmCovBK.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3572 wrote to memory of 4600	3572	JaffaCakes118_f32f0973ac645d486efd6b0d2ba41233.exe	82
PID 3572 wrote to memory of 4600	3572	JaffaCakes118_f32f0973ac645d486efd6b0d2ba41233.exe	82
PID 3572 wrote to memory of 4600	3572	JaffaCakes118_f32f0973ac645d486efd6b0d2ba41233.exe	82

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f32f0973ac645d486efd6b0d2ba41233.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f32f0973ac645d486efd6b0d2ba41233.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\DQsnWZmCovBK.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\DQsnWZmCovBK.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\DQsnWZmCovBK.exe

Filesize
896KB

MD5
d2b3f68ba570b6b73ad4e89191dbf17f

SHA1
b8bf6c5da4a7d9a30635baf0b06644943541a628

SHA256
13c7456acd26c27a0ecb0eda235ccd57b746e516c64377cc4e542c5a2a55895b

SHA512
b544b04b7f58c166cc6093004a4c501eaab4f44cd6cb22aef783913c5479a0439526fd9ccd87ed73d89b4414120a12d39aa793340d174414d6a203453548d27d

Download Submit
memory/4600-12-0x0000000000490000-0x00000000004BE000-memory.dmp

Filesize
184KB

Download
memory/4600-19-0x0000000000490000-0x00000000004BE000-memory.dmp

Filesize
184KB

Download
memory/4600-20-0x000000007340E000-0x000000007340F000-memory.dmp

Filesize
4KB

Download
memory/4600-21-0x00000000009A0000-0x00000000009BE000-memory.dmp

Filesize
120KB

Download
memory/4600-22-0x0000000073400000-0x0000000073BB0000-memory.dmp

Filesize
7.7MB

Download
memory/4600-23-0x0000000005440000-0x0000000005A58000-memory.dmp

Filesize
6.1MB

Download
memory/4600-24-0x0000000073400000-0x0000000073BB0000-memory.dmp

Filesize
7.7MB

Download
memory/4600-25-0x00000000027C0000-0x00000000027D2000-memory.dmp

Filesize
72KB

Download
memory/4600-26-0x0000000005A60000-0x0000000005B6A000-memory.dmp

Filesize
1.0MB

Download
memory/4600-27-0x0000000002860000-0x000000000289C000-memory.dmp

Filesize
240KB

Download
memory/4600-28-0x0000000005B70000-0x0000000005BBC000-memory.dmp

Filesize
304KB

Download
memory/4600-29-0x0000000073400000-0x0000000073BB0000-memory.dmp

Filesize
7.7MB

Download
memory/4600-30-0x0000000073400000-0x0000000073BB0000-memory.dmp

Filesize
7.7MB

Download
memory/4600-31-0x000000007340E000-0x000000007340F000-memory.dmp

Filesize
4KB

Download
memory/4600-32-0x0000000073400000-0x0000000073BB0000-memory.dmp

Filesize
7.7MB

Download
memory/4600-33-0x0000000000550000-0x0000000000636000-memory.dmp

Filesize
920KB

Download