Analysis
-
max time kernel
20s -
max time network
115s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
13-03-2021 08:44
Static task
static1
Behavioral task
behavioral1
Sample
ca65a8331e95305fc9ef541933a7e48f.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
ca65a8331e95305fc9ef541933a7e48f.exe
Resource
win10v20201028
General
-
Target
ca65a8331e95305fc9ef541933a7e48f.exe
-
Size
402KB
-
MD5
ca65a8331e95305fc9ef541933a7e48f
-
SHA1
eef8aa298f25b68ed297a8f2e52b06f37c0e2a1b
-
SHA256
6f9ca1a18eb9a5c5938a9a74a1072a44fbd16685172468e61c7a564a8175c9a7
-
SHA512
6d8dc364bc3c86a4b2e61c729ed531141c6c0756be3d29b7c26531903d5e5ada0609f43a53593ceee412f2d16b8decd4aed7d0db83c60c3d4be200bd4c025002
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3888-7-0x0000000004C60000-0x0000000004C89000-memory.dmp family_redline behavioral2/memory/3888-9-0x0000000007050000-0x0000000007077000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
ca65a8331e95305fc9ef541933a7e48f.exepid process 3888 ca65a8331e95305fc9ef541933a7e48f.exe 3888 ca65a8331e95305fc9ef541933a7e48f.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ca65a8331e95305fc9ef541933a7e48f.exedescription pid process Token: SeDebugPrivilege 3888 ca65a8331e95305fc9ef541933a7e48f.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3888-2-0x0000000002FA0000-0x0000000002FA1000-memory.dmpFilesize
4KB
-
memory/3888-3-0x0000000004B20000-0x0000000004B21000-memory.dmpFilesize
4KB
-
memory/3888-4-0x00000000738F0000-0x0000000073FDE000-memory.dmpFilesize
6.9MB
-
memory/3888-5-0x0000000002FA0000-0x0000000002FD5000-memory.dmpFilesize
212KB
-
memory/3888-6-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3888-7-0x0000000004C60000-0x0000000004C89000-memory.dmpFilesize
164KB
-
memory/3888-8-0x0000000007190000-0x0000000007191000-memory.dmpFilesize
4KB
-
memory/3888-9-0x0000000007050000-0x0000000007077000-memory.dmpFilesize
156KB
-
memory/3888-10-0x0000000007080000-0x0000000007081000-memory.dmpFilesize
4KB
-
memory/3888-11-0x0000000007180000-0x0000000007181000-memory.dmpFilesize
4KB
-
memory/3888-12-0x0000000007182000-0x0000000007183000-memory.dmpFilesize
4KB
-
memory/3888-13-0x0000000007183000-0x0000000007184000-memory.dmpFilesize
4KB
-
memory/3888-14-0x0000000007184000-0x0000000007186000-memory.dmpFilesize
8KB
-
memory/3888-15-0x0000000007BA0000-0x0000000007BA1000-memory.dmpFilesize
4KB
-
memory/3888-16-0x0000000007D80000-0x0000000007D81000-memory.dmpFilesize
4KB
-
memory/3888-17-0x0000000008410000-0x0000000008411000-memory.dmpFilesize
4KB
-
memory/3888-18-0x0000000008530000-0x0000000008531000-memory.dmpFilesize
4KB
-
memory/3888-19-0x00000000085A0000-0x00000000085A1000-memory.dmpFilesize
4KB
-
memory/3888-20-0x0000000008720000-0x0000000008721000-memory.dmpFilesize
4KB
-
memory/3888-21-0x0000000008F20000-0x0000000008F21000-memory.dmpFilesize
4KB
-
memory/3888-22-0x0000000009100000-0x0000000009101000-memory.dmpFilesize
4KB
-
memory/3888-23-0x0000000009750000-0x0000000009751000-memory.dmpFilesize
4KB
-
memory/3888-24-0x0000000009800000-0x0000000009801000-memory.dmpFilesize
4KB
-
memory/3888-25-0x000000000A050000-0x000000000A051000-memory.dmpFilesize
4KB