redline | 6c411da48b1bf36ea29f2f6e02278bb6caaf29ab4feece5daabe4dbbf50772d2

Analysis

max time kernel
137s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2023, 15:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6c411da48b1bf36ea29f2f6e02278bb6caaf29ab4feec.exe
Size 768KB
Sample230715-srbhsabd26
SHA256 6c411da48b1bf36ea29f2f6e02278bb6caaf29ab4feece5daabe4dbbf50772d2
MD5 b10f91b765e8adc96e1b77bed49b2974
SHA1 0df6acec720fed4966d0d988633a838d4353edfa
SHA512 93ec5ccc87c01ffa9a80d644e6fa4f8d259692d212c6269699ea3f52c7f0234cbbf83c23e2db325c17375c4569cb183b53bd470dca006e69582118681a9583a5
SSDEEP 12288:3MrMy90hpzv/xurVnpiAN4BOp16Cm/dCwOEAQXHlK99hqljmdIjpMaYyL7X+03SU:jyov/u9oAN4wp16Cm/MC3la9hnMPt7XD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline lamp infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

lamp

77.91.68.56:19071

Attributes

auth_value
ee1df63bcdbe3de70f52810d94eaff7d

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
3176	x1798833.exe
4652	x5525778.exe
1696	f6168659.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x5525778.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x5525778.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	6c411da48b1bf36ea29f2f6e02278bb6caaf29ab4feec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6c411da48b1bf36ea29f2f6e02278bb6caaf29ab4feec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x1798833.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x1798833.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 3176	4484	6c411da48b1bf36ea29f2f6e02278bb6caaf29ab4feec.exe	86
PID 4484 wrote to memory of 3176	4484	6c411da48b1bf36ea29f2f6e02278bb6caaf29ab4feec.exe	86
PID 4484 wrote to memory of 3176	4484	6c411da48b1bf36ea29f2f6e02278bb6caaf29ab4feec.exe	86
PID 3176 wrote to memory of 4652	3176	x1798833.exe	87
PID 3176 wrote to memory of 4652	3176	x1798833.exe	87
PID 3176 wrote to memory of 4652	3176	x1798833.exe	87
PID 4652 wrote to memory of 1696	4652	x5525778.exe	88
PID 4652 wrote to memory of 1696	4652	x5525778.exe	88
PID 4652 wrote to memory of 1696	4652	x5525778.exe	88

C:\Users\Admin\AppData\Local\Temp\6c411da48b1bf36ea29f2f6e02278bb6caaf29ab4feec.exe
"C:\Users\Admin\AppData\Local\Temp\6c411da48b1bf36ea29f2f6e02278bb6caaf29ab4feec.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1798833.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1798833.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3176
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5525778.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5525778.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4652
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6168659.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6168659.exe
      4⤵
      Executes dropped EXE
      PID:1696

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x1798833.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1798833.exe
Size 612KB
SHA256 d6f5587b5750e966d185457c48780d99554e77cd0dfcc65271e20bae0337cfd2
MD5 e9dc0ee6d955dd478f74ec970af4a3bc
SHA1 2d09c1596b7b9665884cf346b5fa6a6bac1444ee
SHA512 dcee05305d40bf4dc6a9c435c5df91521b31010771b086576587ddcb52ebd1dcb8453f09f6e50601945b1a409ce538669046a7b5789b75ef7f1a68bbe6701c03
SSDEEP 12288:XMrLy90zzvj6yOy16CmWMCwOECQXHlKlAAqljmdImOMaYAG1X9hrS:cygP6Dy16CmW9s3lOAAnpua1X90
MD5 SHA1 SHA512 SSDEEP

Submit Download

x1798833.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1798833.exe
Size 612KB
SHA256 d6f5587b5750e966d185457c48780d99554e77cd0dfcc65271e20bae0337cfd2
MD5 e9dc0ee6d955dd478f74ec970af4a3bc
SHA1 2d09c1596b7b9665884cf346b5fa6a6bac1444ee
SHA512 dcee05305d40bf4dc6a9c435c5df91521b31010771b086576587ddcb52ebd1dcb8453f09f6e50601945b1a409ce538669046a7b5789b75ef7f1a68bbe6701c03
SSDEEP 12288:XMrLy90zzvj6yOy16CmWMCwOECQXHlKlAAqljmdImOMaYAG1X9hrS:cygP6Dy16CmW9s3lOAAnpua1X90
MD5 SHA1 SHA512 SSDEEP

Submit Download

x5525778.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5525778.exe
Size 512KB
SHA256 a639547631e029e6e972fc48ecf710ace51ba5a4d84d8c84d1893da27f635257
MD5 dd29402eabcdb9421672ea1f48088d25
SHA1 f34d0d5c4be65701f3885257cfdd5c8f70b48e37
SHA512 6f65e6b4d1841a67ab76968468d4f4a897afea223b5110e434e9910696c30bbf4b254669842edce179d25d58f53e9f960a3736e825001b53c46d76a2b84504a9
SSDEEP 12288:ZMrTy90aO116CIWECwOELQXHlKAAOq1jmdIMOM5YdC1Xf3rq:myW116CIWlJ3lHAOd71/1Xfm
MD5 SHA1 SHA512 SSDEEP

Submit Download

x5525778.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5525778.exe
Size 512KB
SHA256 a639547631e029e6e972fc48ecf710ace51ba5a4d84d8c84d1893da27f635257
MD5 dd29402eabcdb9421672ea1f48088d25
SHA1 f34d0d5c4be65701f3885257cfdd5c8f70b48e37
SHA512 6f65e6b4d1841a67ab76968468d4f4a897afea223b5110e434e9910696c30bbf4b254669842edce179d25d58f53e9f960a3736e825001b53c46d76a2b84504a9
SSDEEP 12288:ZMrTy90aO116CIWECwOELQXHlKAAOq1jmdIMOM5YdC1Xf3rq:myW116CIWlJ3lHAOd71/1Xfm
MD5 SHA1 SHA512 SSDEEP

Submit Download

f6168659.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6168659.exe
Size 489KB
SHA256 aed053be353fca1c1b0762a0071083cdf8a005ffe513dcf2a405c0f1e71e5a2a
MD5 251cb84b3cd1d05b534b20a184ffae30
SHA1 abe1f05f47f960d43926f6e1c84db371ca7026d8
SHA512 3e30d0bb945613c54ee053de38bf2453572d4d0818982bd9e6984378ea9f9eef0fe9378c25aaaf4608cdb71871641fff3f27f54a67fc336168b209bef15f1399
SSDEEP 12288:zIlL1N35w33+dlwWO51oK4Pw9tz0HpkC:zUN3MYODoK4Y9tzckC
MD5 SHA1 SHA512 SSDEEP

Submit Download

f6168659.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6168659.exe
Size 489KB
SHA256 aed053be353fca1c1b0762a0071083cdf8a005ffe513dcf2a405c0f1e71e5a2a
MD5 251cb84b3cd1d05b534b20a184ffae30
SHA1 abe1f05f47f960d43926f6e1c84db371ca7026d8
SHA512 3e30d0bb945613c54ee053de38bf2453572d4d0818982bd9e6984378ea9f9eef0fe9378c25aaaf4608cdb71871641fff3f27f54a67fc336168b209bef15f1399
SSDEEP 12288:zIlL1N35w33+dlwWO51oK4Pw9tz0HpkC:zUN3MYODoK4Y9tzckC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1696-161-0x0000000074B20000-0x00000000752D0000-memory.dmp

Download

memory/1696-155-0x00000000005A0000-0x000000000062C000-memory.dmp

Download

memory/1696-154-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/1696-162-0x00000000005A0000-0x000000000062C000-memory.dmp

Download

memory/1696-163-0x0000000004530000-0x0000000004531000-memory.dmp

Download

memory/1696-164-0x0000000004B20000-0x0000000005138000-memory.dmp

Download

memory/1696-165-0x0000000005140000-0x000000000524A000-memory.dmp

Download

memory/1696-167-0x0000000004B10000-0x0000000004B20000-memory.dmp

Download

memory/1696-166-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Download

memory/1696-168-0x0000000004AC0000-0x0000000004AFC000-memory.dmp

Download

memory/1696-169-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/1696-170-0x0000000074B20000-0x00000000752D0000-memory.dmp

Download

memory/1696-171-0x0000000004B10000-0x0000000004B20000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads