redline | f6fd998eb46fb062dbf347e930778b3fa121f696b1760de8a4d047fc8c19322c

Analysis

max time kernel
139s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2023, 13:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4f430a4de13f0e4d51ce4b93b9dc7611.exe
Size 770KB
Sample230715-qext5sag22
SHA256 f6fd998eb46fb062dbf347e930778b3fa121f696b1760de8a4d047fc8c19322c
MD5 4f430a4de13f0e4d51ce4b93b9dc7611
SHA1 c014615bff0138f1decba07ae0ac5bb42e217503
SHA512 206a053fd6437ca07ed58004197b4e9d9741a7e24a2433ceed4017f5750b0f050af96f300e8c6ce4e5449c17e4bc9161c5820e1b60cca98d08170b2a98d1b113
SSDEEP 12288:SMrSy9088kQPhnS8UkSYzNMxq0CiTLvIz+P4S0wKJFJhuOhPKNWhxmutinwn0m:MyVIPhSehIkiTLlP4SMvnMNW+rm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline lamp infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

lamp

77.91.68.56:19071

Attributes

auth_value
ee1df63bcdbe3de70f52810d94eaff7d

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
1212	x8300663.exe
2000	x5006971.exe
2336	f5623029.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	4f430a4de13f0e4d51ce4b93b9dc7611.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	4f430a4de13f0e4d51ce4b93b9dc7611.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x8300663.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x8300663.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x5006971.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x5006971.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 1212	652	4f430a4de13f0e4d51ce4b93b9dc7611.exe	84
PID 652 wrote to memory of 1212	652	4f430a4de13f0e4d51ce4b93b9dc7611.exe	84
PID 652 wrote to memory of 1212	652	4f430a4de13f0e4d51ce4b93b9dc7611.exe	84
PID 1212 wrote to memory of 2000	1212	x8300663.exe	85
PID 1212 wrote to memory of 2000	1212	x8300663.exe	85
PID 1212 wrote to memory of 2000	1212	x8300663.exe	85
PID 2000 wrote to memory of 2336	2000	x5006971.exe	86
PID 2000 wrote to memory of 2336	2000	x5006971.exe	86
PID 2000 wrote to memory of 2336	2000	x5006971.exe	86

C:\Users\Admin\AppData\Local\Temp\4f430a4de13f0e4d51ce4b93b9dc7611.exe
"C:\Users\Admin\AppData\Local\Temp\4f430a4de13f0e4d51ce4b93b9dc7611.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:652
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8300663.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8300663.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1212
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5006971.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5006971.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2000
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f5623029.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f5623029.exe
      4⤵
      Executes dropped EXE
      PID:2336

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x8300663.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8300663.exe
Size 614KB
SHA256 3480c60aa696b7f73ca37b45eaa55fc46a138b86f59ee258ff88d742e35c7f98
MD5 8ab49badfc4a0d48d380eacde263b293
SHA1 ab163738e44ab45a3ef1b5786061f8c4958125df
SHA512 6f68d356205601cd785dd5e493d088690343b0563291cbeefa05fac048140d2ea319817793cce8e14b8abb8e5db3dfa3d20c8873a420c2f1cfe946fecdafcb43
SSDEEP 12288:ZMray90fKkJZyO0kSYzNMxbIj1ULvSzbP4SlwKDFJjucOzMpJ+:fyZshIk1ULGP4S5xTIyY
MD5 SHA1 SHA512 SSDEEP

Submit Download

x8300663.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8300663.exe
Size 614KB
SHA256 3480c60aa696b7f73ca37b45eaa55fc46a138b86f59ee258ff88d742e35c7f98
MD5 8ab49badfc4a0d48d380eacde263b293
SHA1 ab163738e44ab45a3ef1b5786061f8c4958125df
SHA512 6f68d356205601cd785dd5e493d088690343b0563291cbeefa05fac048140d2ea319817793cce8e14b8abb8e5db3dfa3d20c8873a420c2f1cfe946fecdafcb43
SSDEEP 12288:ZMray90fKkJZyO0kSYzNMxbIj1ULvSzbP4SlwKDFJjucOzMpJ+:fyZshIk1ULGP4S5xTIyY
MD5 SHA1 SHA512 SSDEEP

Submit Download

x5006971.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5006971.exe
Size 513KB
SHA256 2537cbbe90a75e20b256f80ec50e1dceb4a628c4df51ea77763fee7a3e7d8740
MD5 1ffa0cae22e4467a210fa41c3289a776
SHA1 a87e359f54828b44b21ae89479e949f6a0bf14cf
SHA512 b99c33ecd98bebec19d4d26989b9822e45e9ffa6f6cfa7277bdb2a967e196f32dc3b477dbdc6da9c4d71de2756b1b6d116185c81af838f5ac7a5f8e5bd16efd0
SSDEEP 12288:sMrKy90oWfFmvmAuiLvSzOP4SjwKFmSjAvadMpG:GyXWkmAuiLnP4SjAP0yG
MD5 SHA1 SHA512 SSDEEP

Submit Download

x5006971.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5006971.exe
Size 513KB
SHA256 2537cbbe90a75e20b256f80ec50e1dceb4a628c4df51ea77763fee7a3e7d8740
MD5 1ffa0cae22e4467a210fa41c3289a776
SHA1 a87e359f54828b44b21ae89479e949f6a0bf14cf
SHA512 b99c33ecd98bebec19d4d26989b9822e45e9ffa6f6cfa7277bdb2a967e196f32dc3b477dbdc6da9c4d71de2756b1b6d116185c81af838f5ac7a5f8e5bd16efd0
SSDEEP 12288:sMrKy90oWfFmvmAuiLvSzOP4SjwKFmSjAvadMpG:GyXWkmAuiLnP4SjAP0yG
MD5 SHA1 SHA512 SSDEEP

Submit Download

f5623029.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f5623029.exe
Size 490KB
SHA256 5068b035f03387c6879d21ad1073db3a5f8ca3fb7ae5fe5c016d38c20a71fb11
MD5 d9bc3958d12ba4e1025d42d2f6c13e77
SHA1 3017fa8b1f87bd7a997f69993b39201f77f38c72
SHA512 b55dbe3ba32c029b4bd9a992279556097f509ec4f37d0e4364009bb5d6fd0410352e3635d9bdb8a72cf031b2cfcb8d025bbf2399ff5d773f8b70038cfdb1fc55
SSDEEP 12288:w2F8W+5BPESjwTWJ6GK4Hjo1g6KusQIviRgpv:wc+zPESl6GK4ykQxRgR
MD5 SHA1 SHA512 SSDEEP

Submit Download

f5623029.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f5623029.exe
Size 490KB
SHA256 5068b035f03387c6879d21ad1073db3a5f8ca3fb7ae5fe5c016d38c20a71fb11
MD5 d9bc3958d12ba4e1025d42d2f6c13e77
SHA1 3017fa8b1f87bd7a997f69993b39201f77f38c72
SHA512 b55dbe3ba32c029b4bd9a992279556097f509ec4f37d0e4364009bb5d6fd0410352e3635d9bdb8a72cf031b2cfcb8d025bbf2399ff5d773f8b70038cfdb1fc55
SSDEEP 12288:w2F8W+5BPESjwTWJ6GK4Hjo1g6KusQIviRgpv:wc+zPESl6GK4ykQxRgR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2336-154-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/2336-155-0x0000000001F70000-0x0000000001FFC000-memory.dmp

Download

memory/2336-161-0x00000000745E0000-0x0000000074D90000-memory.dmp

Download

memory/2336-162-0x0000000001F70000-0x0000000001FFC000-memory.dmp

Download

memory/2336-163-0x00000000025A0000-0x00000000025A1000-memory.dmp

Download

memory/2336-164-0x0000000005020000-0x0000000005638000-memory.dmp

Download

memory/2336-165-0x0000000004A90000-0x0000000004B9A000-memory.dmp

Download

memory/2336-167-0x0000000006C20000-0x0000000006C30000-memory.dmp

Download

memory/2336-166-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Download

memory/2336-168-0x0000000004BE0000-0x0000000004C1C000-memory.dmp

Download

memory/2336-169-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/2336-170-0x00000000745E0000-0x0000000074D90000-memory.dmp

Download

memory/2336-171-0x0000000006C20000-0x0000000006C30000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads