redline | dbeb77768d887fa33ddb417e397b2bf2992748d6c7d618b907cb6a955337f113

Analysis

max time kernel
146s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 15:47

Target

169441f77be08d744d5a3c470cba54de_JaffaCakes118.exe
Size

378KB
MD5

169441f77be08d744d5a3c470cba54de
SHA1

9a2cdd4b6646902e033470abc659696ef5476b3a
SHA256

dbeb77768d887fa33ddb417e397b2bf2992748d6c7d618b907cb6a955337f113
SHA512

160ce2428b29c37cb24db34c1dfefe212fc2cb74ae793373b0de1eb9a38da4adeb3590945884ef589ba0d8fd24a7672eb4d47e25143d714c64bfb64d71d85215
SSDEEP

6144:Fry6wBK8O0e0nG7RP729lkszXNEohb7AHKROhxxpeTr/ekIfsu:86wBK8Pe0netwlksruwmzxp6LMsu

Score

10^/10

Family

redline

Botnet

80.87.192.249:16640

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
RedLine payload 2 IoCs

Processes:

resource yara_rule

behavioral2/memory/3896-5-0x0000000002570000-0x0000000002596000-memory.dmp family_redline
behavioral2/memory/3896-7-0x0000000004B00000-0x0000000004B24000-memory.dmp family_redline
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

resource	yara_rule
behavioral2/memory/3896-5-0x0000000002570000-0x0000000002596000-memory.dmp	family_redline
behavioral2/memory/3896-7-0x0000000004B00000-0x0000000004B24000-memory.dmp	family_redline

SectopRAT payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3896-5-0x0000000002570000-0x0000000002596000-memory.dmp	family_sectoprat
behavioral2/memory/3896-7-0x0000000004B00000-0x0000000004B24000-memory.dmp	family_sectoprat

C:\Users\Admin\AppData\Local\Temp\169441f77be08d744d5a3c470cba54de_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\169441f77be08d744d5a3c470cba54de_JaffaCakes118.exe"
1⤵
PID:3896

memory/3896-1-0x0000000000490000-0x0000000000590000-memory.dmp

Filesize
1024KB

Download
memory/3896-2-0x00000000001C0000-0x00000000001F0000-memory.dmp

Filesize
192KB

Download
memory/3896-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3896-4-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/3896-5-0x0000000002570000-0x0000000002596000-memory.dmp

Filesize
152KB

Download
memory/3896-6-0x0000000004C00000-0x00000000051A4000-memory.dmp

Filesize
5.6MB

Download
memory/3896-7-0x0000000004B00000-0x0000000004B24000-memory.dmp

Filesize
144KB

Download
memory/3896-8-0x00000000051B0000-0x00000000057C8000-memory.dmp

Filesize
6.1MB

Download
memory/3896-9-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/3896-10-0x00000000057D0000-0x00000000058DA000-memory.dmp

Filesize
1.0MB

Download
memory/3896-11-0x00000000058E0000-0x000000000591C000-memory.dmp

Filesize
240KB

Download
memory/3896-12-0x0000000005950000-0x000000000599C000-memory.dmp

Filesize
304KB

Download
memory/3896-13-0x0000000000490000-0x0000000000590000-memory.dmp

Filesize
1024KB

Download
memory/3896-15-0x00000000001C0000-0x00000000001F0000-memory.dmp

Filesize
192KB

Download