redline | 616c964b04fc0f8c3ef10e9878c812a41fe6111f54eb3c8b02f40d0a3381c58c

Analysis

max time kernel
139s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2023, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6bb70b5a9261483495d713df402f16be.exe
Size 770KB
Sample230715-pp2emsad84
SHA256 616c964b04fc0f8c3ef10e9878c812a41fe6111f54eb3c8b02f40d0a3381c58c
MD5 6bb70b5a9261483495d713df402f16be
SHA1 aad20e11e47e05c5ceefa0f89d904dc2cda5d35f
SHA512 7c83477b2d06746ad22e31d5c9b4f8d24dae30abbe4cfee611270fd6e363106e5b26eedbc7552fd97a6be39efdc3f5f73f0060e53ff1ae515b5162958b4bb4bd
SSDEEP 12288:CMruy90uZgim4eMsZxNy74kQEeYWb4DhTFWlm+Cb2L/PISwtTkaB:wyZg2JAA6ZdfL/6Ia
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline lamp infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

lamp

77.91.68.56:19071

Attributes

auth_value
ee1df63bcdbe3de70f52810d94eaff7d

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
4772	x3735468.exe
824	x2375164.exe
4536	f5904468.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x3735468.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x2375164.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x2375164.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	6bb70b5a9261483495d713df402f16be.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6bb70b5a9261483495d713df402f16be.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x3735468.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 4772	4340	6bb70b5a9261483495d713df402f16be.exe	85
PID 4340 wrote to memory of 4772	4340	6bb70b5a9261483495d713df402f16be.exe	85
PID 4340 wrote to memory of 4772	4340	6bb70b5a9261483495d713df402f16be.exe	85
PID 4772 wrote to memory of 824	4772	x3735468.exe	86
PID 4772 wrote to memory of 824	4772	x3735468.exe	86
PID 4772 wrote to memory of 824	4772	x3735468.exe	86
PID 824 wrote to memory of 4536	824	x2375164.exe	87
PID 824 wrote to memory of 4536	824	x2375164.exe	87
PID 824 wrote to memory of 4536	824	x2375164.exe	87

C:\Users\Admin\AppData\Local\Temp\6bb70b5a9261483495d713df402f16be.exe
"C:\Users\Admin\AppData\Local\Temp\6bb70b5a9261483495d713df402f16be.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3735468.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3735468.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x2375164.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x2375164.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:824
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f5904468.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f5904468.exe
      4⤵
      Executes dropped EXE
      PID:4536

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x3735468.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3735468.exe
Size 614KB
SHA256 f6fee9de85c9b950706251947f7bebc4abc618b58ded5127a13f9ed41ed049bf
MD5 42bcc00aec83c1ff840a2983ef2ee12c
SHA1 4e8c5accb7d9460ad4ffd019cfebf9746c674c61
SHA512 886b3d7deda13879649a9d2090c3eb8f6d456132ce1c15501f59f37b66ee8936eab8cfa4e3c2c30c47c03746004c087cdcd45a8c7fc756bddf785dd2228c5de4
SSDEEP 12288:oMr3y901BM9ZoNy7hkQ1euWb4VDNO5Qm+nb9LkPS:/y6C4EwSdBLkK
MD5 SHA1 SHA512 SSDEEP

Submit Download

x3735468.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3735468.exe
Size 614KB
SHA256 f6fee9de85c9b950706251947f7bebc4abc618b58ded5127a13f9ed41ed049bf
MD5 42bcc00aec83c1ff840a2983ef2ee12c
SHA1 4e8c5accb7d9460ad4ffd019cfebf9746c674c61
SHA512 886b3d7deda13879649a9d2090c3eb8f6d456132ce1c15501f59f37b66ee8936eab8cfa4e3c2c30c47c03746004c087cdcd45a8c7fc756bddf785dd2228c5de4
SSDEEP 12288:oMr3y901BM9ZoNy7hkQ1euWb4VDNO5Qm+nb9LkPS:/y6C4EwSdBLkK
MD5 SHA1 SHA512 SSDEEP

Submit Download

x2375164.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x2375164.exe
Size 513KB
SHA256 357b6f8d5d35eae69e01d7c80d1038ab5076e5cdfd09ef903fbb371b64460028
MD5 491d438785a11c6138c61ac0e093d5a6
SHA1 ed35ecf75f97eb4d09302ae32cb7655b767684d5
SHA512 349c5a17eab7b953b630679f0f18a9535bb490699febc2c75d51675c223c798f19e9878bb930bba3175e829f441cc57e083c4e9a028b13f4bae0b0d910c28a7c
SSDEEP 6144:KTy+bnr+Mp0yN90QEAeCCZI3AMWbv9E2fh1euox7nUU0BnQmeTpjI9xU8zIirLGH:dMr0y90y3XWblb1NSEQm+YKELBP6
MD5 SHA1 SHA512 SSDEEP

Submit Download

x2375164.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x2375164.exe
Size 513KB
SHA256 357b6f8d5d35eae69e01d7c80d1038ab5076e5cdfd09ef903fbb371b64460028
MD5 491d438785a11c6138c61ac0e093d5a6
SHA1 ed35ecf75f97eb4d09302ae32cb7655b767684d5
SHA512 349c5a17eab7b953b630679f0f18a9535bb490699febc2c75d51675c223c798f19e9878bb930bba3175e829f441cc57e083c4e9a028b13f4bae0b0d910c28a7c
SSDEEP 6144:KTy+bnr+Mp0yN90QEAeCCZI3AMWbv9E2fh1euox7nUU0BnQmeTpjI9xU8zIirLGH:dMr0y90y3XWblb1NSEQm+YKELBP6
MD5 SHA1 SHA512 SSDEEP

Submit Download

f5904468.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f5904468.exe
Size 491KB
SHA256 2e3b9f95405d65bdb0212156cc301740245c0295906ea835363b884c74a35b47
MD5 bafc2d66519274242cea2363d2b8f8cb
SHA1 a4d1203c593f250aa82c4f4196ba6d56dbed0d86
SHA512 fea04af153ab8cb43173478b730dd0fb3c6749859fa6dc28374afa13d41854f42a4452bfa9baa0af44d507b985a634c66e12fe9028f361d10496607ba7e99228
SSDEEP 12288:KE3MMZnsO8es7OQlFa42Jk3K4v263YyRiCJYf0rj:hpT8H1K473YyRF
MD5 SHA1 SHA512 SSDEEP

Submit Download

f5904468.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f5904468.exe
Size 491KB
SHA256 2e3b9f95405d65bdb0212156cc301740245c0295906ea835363b884c74a35b47
MD5 bafc2d66519274242cea2363d2b8f8cb
SHA1 a4d1203c593f250aa82c4f4196ba6d56dbed0d86
SHA512 fea04af153ab8cb43173478b730dd0fb3c6749859fa6dc28374afa13d41854f42a4452bfa9baa0af44d507b985a634c66e12fe9028f361d10496607ba7e99228
SSDEEP 12288:KE3MMZnsO8es7OQlFa42Jk3K4v263YyRiCJYf0rj:hpT8H1K473YyRF
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4536-154-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/4536-155-0x00000000005B0000-0x000000000063C000-memory.dmp

Download

memory/4536-161-0x0000000074B80000-0x0000000075330000-memory.dmp

Download

memory/4536-162-0x00000000005B0000-0x000000000063C000-memory.dmp

Download

memory/4536-163-0x0000000006B30000-0x0000000006B31000-memory.dmp

Download

memory/4536-164-0x00000000049E0000-0x0000000004FF8000-memory.dmp

Download

memory/4536-165-0x0000000005090000-0x000000000519A000-memory.dmp

Download

memory/4536-166-0x0000000006C50000-0x0000000006C60000-memory.dmp

Download

memory/4536-167-0x00000000051C0000-0x00000000051D2000-memory.dmp

Download

memory/4536-168-0x00000000051E0000-0x000000000521C000-memory.dmp

Download

memory/4536-169-0x0000000074B80000-0x0000000075330000-memory.dmp

Download

memory/4536-170-0x0000000006C50000-0x0000000006C60000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads