Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
25-06-2024 08:45
Static task
static1
Behavioral task
behavioral1
Sample
0d6c896c5a03275b016b6c396a3188d6_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
0d6c896c5a03275b016b6c396a3188d6_JaffaCakes118.exe
-
Size
3.3MB
-
MD5
0d6c896c5a03275b016b6c396a3188d6
-
SHA1
3b4d5c81b97d58770adffec69073745e938c93b2
-
SHA256
ef4bfc8695a0eef80365ae2e0bbf8078045e10e71a33e5fcae0c2ffddd923001
-
SHA512
f5bd40920803a173a5db025f04a3620065bcf0f2c87d8469a33a1729424180483d06ec05934e24c76d58c03108616e42aa68efe2be085f1a8c330fa81da32528
-
SSDEEP
49152:ij5TDib7I2qjdhcqEpQeiJcCCmmO5VxwHKvRGsb3/Zw5YNUhrDOHk5+Z:ij5T2bwrxZsFmLvSIGsba6N2PUgk
Malware Config
Extracted
redline
mastif
194.156.99.23:5133
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4448-81-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SectopRAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2388-53-0x0000000000B00000-0x000000000120C000-memory.dmp family_sectoprat behavioral2/memory/2388-54-0x0000000000B00000-0x000000000120C000-memory.dmp family_sectoprat behavioral2/memory/4448-81-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
@hvhbig0wner_protected.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ @hvhbig0wner_protected.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
@hvhbig0wner_protected.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion @hvhbig0wner_protected.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion @hvhbig0wner_protected.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0d6c896c5a03275b016b6c396a3188d6_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation 0d6c896c5a03275b016b6c396a3188d6_JaffaCakes118.exe -
Executes dropped EXE 3 IoCs
Processes:
@hvhbig0wner_protected.exebitch.exebitch.exepid process 2388 @hvhbig0wner_protected.exe 720 bitch.exe 4448 bitch.exe -
Loads dropped DLL 1 IoCs
Processes:
bitch.exepid process 720 bitch.exe -
Obfuscated with Agile.Net obfuscator 2 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\bitch.exe agile_net behavioral2/memory/720-27-0x0000000000820000-0x000000000095C000-memory.dmp agile_net -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\@hvhbig0wner_protected.exe themida behavioral2/memory/2388-53-0x0000000000B00000-0x000000000120C000-memory.dmp themida behavioral2/memory/2388-54-0x0000000000B00000-0x000000000120C000-memory.dmp themida -
Processes:
@hvhbig0wner_protected.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA @hvhbig0wner_protected.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
@hvhbig0wner_protected.exepid process 2388 @hvhbig0wner_protected.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
bitch.exedescription pid process target process PID 720 set thread context of 4448 720 bitch.exe bitch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
@hvhbig0wner_protected.exebitch.exedescription pid process Token: SeDebugPrivilege 2388 @hvhbig0wner_protected.exe Token: SeDebugPrivilege 4448 bitch.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
0d6c896c5a03275b016b6c396a3188d6_JaffaCakes118.exebitch.exedescription pid process target process PID 2200 wrote to memory of 2388 2200 0d6c896c5a03275b016b6c396a3188d6_JaffaCakes118.exe @hvhbig0wner_protected.exe PID 2200 wrote to memory of 2388 2200 0d6c896c5a03275b016b6c396a3188d6_JaffaCakes118.exe @hvhbig0wner_protected.exe PID 2200 wrote to memory of 2388 2200 0d6c896c5a03275b016b6c396a3188d6_JaffaCakes118.exe @hvhbig0wner_protected.exe PID 2200 wrote to memory of 720 2200 0d6c896c5a03275b016b6c396a3188d6_JaffaCakes118.exe bitch.exe PID 2200 wrote to memory of 720 2200 0d6c896c5a03275b016b6c396a3188d6_JaffaCakes118.exe bitch.exe PID 2200 wrote to memory of 720 2200 0d6c896c5a03275b016b6c396a3188d6_JaffaCakes118.exe bitch.exe PID 720 wrote to memory of 4448 720 bitch.exe bitch.exe PID 720 wrote to memory of 4448 720 bitch.exe bitch.exe PID 720 wrote to memory of 4448 720 bitch.exe bitch.exe PID 720 wrote to memory of 4448 720 bitch.exe bitch.exe PID 720 wrote to memory of 4448 720 bitch.exe bitch.exe PID 720 wrote to memory of 4448 720 bitch.exe bitch.exe PID 720 wrote to memory of 4448 720 bitch.exe bitch.exe PID 720 wrote to memory of 4448 720 bitch.exe bitch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d6c896c5a03275b016b6c396a3188d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0d6c896c5a03275b016b6c396a3188d6_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\@hvhbig0wner_protected.exe"C:\Users\Admin\AppData\Local\Temp\@hvhbig0wner_protected.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\bitch.exe"C:\Users\Admin\AppData\Local\Temp\bitch.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bitch.exe"C:\Users\Admin\AppData\Local\Temp\bitch.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\bitch.exe.logFilesize
1KB
MD53bc21ec263f48f5bd52658c434ee56ce
SHA12c1c11bf070bc87bb9aa67199795b9d2d7acfc72
SHA256c2b54f29b07e29e79ae2de4883246525ae059be380708363933d7e509f5516a1
SHA512f137d81e6d9ca955d4d416fa629db39e6bc3a88dbaa78e6f1610c2bc564eb26ccf75640b10c19ca81e4e35cc922a9abd01d78ba4e92aad549c0a7086ae890fe5
-
C:\Users\Admin\AppData\Local\Temp\43fe2834-1678-4796-b583-40edcd85778a\AgileDotNetRT.dllFilesize
88KB
MD5dfbb922abc575559fe4d9d7f2fd0d7b6
SHA117794751e3e258067b862a75f07fd62fcfd7a154
SHA256d2280254594d3e51d2616a960491b65b4f057aea7208a7eef7310c52ee95a6c2
SHA512a4f2e8f825ad1f291d6448a30ee08eef062d664986d22b7fde818aeceb94d4a052e86e091b3e940ea7707807c1b97190958c3cc17791ae3680de3056c49f2f52
-
C:\Users\Admin\AppData\Local\Temp\@hvhbig0wner_protected.exeFilesize
2.4MB
MD54be2db7166f7f115aa3d5c0039853517
SHA1b0fd9b8c2e08dbe168615647aeaec1ce2aaf8a75
SHA2565db5b60d090ec79a786dd4ff35eeac136db3a780143d4f5406f69782aab8e2e0
SHA512840ffcafdd6732e1e88ea435e24560d760f6de4ea5888b55de1c01718a959460d2a07ca2ec1611562aeea21e17e030b4b1b570ea7baf240ff87489f8d1b13509
-
C:\Users\Admin\AppData\Local\Temp\bitch.exeFilesize
1.2MB
MD5d8bc4252af94863ae839997be45d9960
SHA17bcd4df0a8d7dbf0fb472b5e0271711977e7d817
SHA256513bbc0e46245839d626a178e567eceae0de663909d5594be55bb6fdef40ba1b
SHA5120eae0a66e1d88989db04c7d672ba4376fe438026cd692d5ed1490bf951941e72c5c3d597d5ceb0eda615092cccdbf03e442c51c7064a915bd1d6eadcc246564e
-
memory/720-31-0x0000000005350000-0x00000000056A4000-memory.dmpFilesize
3.3MB
-
memory/720-40-0x0000000006010000-0x00000000060AC000-memory.dmpFilesize
624KB
-
memory/720-27-0x0000000000820000-0x000000000095C000-memory.dmpFilesize
1.2MB
-
memory/720-28-0x0000000005860000-0x0000000005E04000-memory.dmpFilesize
5.6MB
-
memory/720-29-0x0000000074EE0000-0x0000000075690000-memory.dmpFilesize
7.7MB
-
memory/720-30-0x00000000052B0000-0x0000000005342000-memory.dmpFilesize
584KB
-
memory/720-62-0x0000000074EEE000-0x0000000074EEF000-memory.dmpFilesize
4KB
-
memory/720-85-0x0000000074EE0000-0x0000000075690000-memory.dmpFilesize
7.7MB
-
memory/720-39-0x00000000738F0000-0x0000000073979000-memory.dmpFilesize
548KB
-
memory/720-26-0x0000000074EEE000-0x0000000074EEF000-memory.dmpFilesize
4KB
-
memory/720-42-0x0000000006460000-0x00000000064B6000-memory.dmpFilesize
344KB
-
memory/720-41-0x0000000005830000-0x000000000583A000-memory.dmpFilesize
40KB
-
memory/720-45-0x0000000006400000-0x0000000006426000-memory.dmpFilesize
152KB
-
memory/720-80-0x0000000005210000-0x0000000005236000-memory.dmpFilesize
152KB
-
memory/720-79-0x0000000006AA0000-0x0000000006B0C000-memory.dmpFilesize
432KB
-
memory/720-63-0x0000000074EE0000-0x0000000075690000-memory.dmpFilesize
7.7MB
-
memory/2200-1-0x0000000000600000-0x000000000094C000-memory.dmpFilesize
3.3MB
-
memory/2200-0-0x00007FFF46A93000-0x00007FFF46A95000-memory.dmpFilesize
8KB
-
memory/2388-49-0x0000000077220000-0x0000000077310000-memory.dmpFilesize
960KB
-
memory/2388-64-0x0000000077240000-0x0000000077241000-memory.dmpFilesize
4KB
-
memory/2388-54-0x0000000000B00000-0x000000000120C000-memory.dmpFilesize
7.0MB
-
memory/2388-55-0x0000000006370000-0x0000000006988000-memory.dmpFilesize
6.1MB
-
memory/2388-56-0x00000000039E0000-0x00000000039F2000-memory.dmpFilesize
72KB
-
memory/2388-57-0x0000000005C50000-0x0000000005C8C000-memory.dmpFilesize
240KB
-
memory/2388-58-0x0000000005C90000-0x0000000005CDC000-memory.dmpFilesize
304KB
-
memory/2388-59-0x0000000005EF0000-0x0000000005FFA000-memory.dmpFilesize
1.0MB
-
memory/2388-61-0x0000000000B00000-0x000000000120C000-memory.dmpFilesize
7.0MB
-
memory/2388-44-0x0000000077220000-0x0000000077310000-memory.dmpFilesize
960KB
-
memory/2388-47-0x0000000077220000-0x0000000077310000-memory.dmpFilesize
960KB
-
memory/2388-53-0x0000000000B00000-0x000000000120C000-memory.dmpFilesize
7.0MB
-
memory/2388-66-0x0000000077220000-0x0000000077310000-memory.dmpFilesize
960KB
-
memory/2388-67-0x0000000077220000-0x0000000077310000-memory.dmpFilesize
960KB
-
memory/2388-68-0x0000000077220000-0x0000000077310000-memory.dmpFilesize
960KB
-
memory/2388-69-0x0000000077220000-0x0000000077310000-memory.dmpFilesize
960KB
-
memory/2388-70-0x0000000077220000-0x0000000077310000-memory.dmpFilesize
960KB
-
memory/2388-48-0x0000000077220000-0x0000000077310000-memory.dmpFilesize
960KB
-
memory/2388-46-0x0000000077220000-0x0000000077310000-memory.dmpFilesize
960KB
-
memory/2388-24-0x0000000000B00000-0x000000000120C000-memory.dmpFilesize
7.0MB
-
memory/2388-43-0x0000000077240000-0x0000000077241000-memory.dmpFilesize
4KB
-
memory/4448-81-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB