redline | f8008675eee8ef82dd1b56c2b400ab345f415ca32bdafec51bc50ed4550c10ea

Analysis

max time kernel
136s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2023, 15:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
67d9bd6780aaac40f3ed30c220748ee4.exe
Size 768KB
Sample230715-srbhsacc2t
SHA256 f8008675eee8ef82dd1b56c2b400ab345f415ca32bdafec51bc50ed4550c10ea
MD5 67d9bd6780aaac40f3ed30c220748ee4
SHA1 30f6c1fc87a1f87550560a77be2798e306441c93
SHA512 acbddf34c849c270e5a766551e185ef778615102f135f504deb7eb79bb61b61a5123b4db772a76486a6de48731296170e1bf2dcb70a3bd58483df31a3853875a
SSDEEP 24576:By7Rg5TFd4U3xdA8aTJiZqeGfAFGImPpKxOoRjVt:0C5f2gQe0aRj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline lamp infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

lamp

77.91.68.56:19071

Attributes

auth_value
ee1df63bcdbe3de70f52810d94eaff7d

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
4564	x2977053.exe
5112	x5291614.exe
4028	f6503608.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x5291614.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x5291614.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	67d9bd6780aaac40f3ed30c220748ee4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	67d9bd6780aaac40f3ed30c220748ee4.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x2977053.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x2977053.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 4564	1756	67d9bd6780aaac40f3ed30c220748ee4.exe	85
PID 1756 wrote to memory of 4564	1756	67d9bd6780aaac40f3ed30c220748ee4.exe	85
PID 1756 wrote to memory of 4564	1756	67d9bd6780aaac40f3ed30c220748ee4.exe	85
PID 4564 wrote to memory of 5112	4564	x2977053.exe	86
PID 4564 wrote to memory of 5112	4564	x2977053.exe	86
PID 4564 wrote to memory of 5112	4564	x2977053.exe	86
PID 5112 wrote to memory of 4028	5112	x5291614.exe	87
PID 5112 wrote to memory of 4028	5112	x5291614.exe	87
PID 5112 wrote to memory of 4028	5112	x5291614.exe	87

C:\Users\Admin\AppData\Local\Temp\67d9bd6780aaac40f3ed30c220748ee4.exe
"C:\Users\Admin\AppData\Local\Temp\67d9bd6780aaac40f3ed30c220748ee4.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2977053.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2977053.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4564
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5291614.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5291614.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6503608.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6503608.exe
      4⤵
      Executes dropped EXE
      PID:4028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x2977053.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2977053.exe
Size 613KB
SHA256 01a708fcc01ac5f7d80e2007951df212d447dd3c3d72be6a8127993df959f8e7
MD5 3d6c9939b331ad3f22447f8c05f5cf03
SHA1 ad90c7166af1cfab9e0d8484e2e055833f301588
SHA512 d7dd31e796471d8bd0f4c5b5c993d6d3f6decc3c8d4e14a0cbd1f3f5b0887d5ea509e723f1ea436a297546e21b44a8a55f7e8fee4c7ae28dd1d9e1222df12fab
SSDEEP 12288:1Mrry90m/517SjHo4Ul3WIICF8riTJIZqeQfnUuySMFwm5ph4HvnivrcJ4:eyL5l2o4UdhIA8+TJIZqeQf1FWwm5cHU
MD5 SHA1 SHA512 SSDEEP

Submit Download

x2977053.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2977053.exe
Size 613KB
SHA256 01a708fcc01ac5f7d80e2007951df212d447dd3c3d72be6a8127993df959f8e7
MD5 3d6c9939b331ad3f22447f8c05f5cf03
SHA1 ad90c7166af1cfab9e0d8484e2e055833f301588
SHA512 d7dd31e796471d8bd0f4c5b5c993d6d3f6decc3c8d4e14a0cbd1f3f5b0887d5ea509e723f1ea436a297546e21b44a8a55f7e8fee4c7ae28dd1d9e1222df12fab
SSDEEP 12288:1Mrry90m/517SjHo4Ul3WIICF8riTJIZqeQfnUuySMFwm5ph4HvnivrcJ4:eyL5l2o4UdhIA8+TJIZqeQf1FWwm5cHU
MD5 SHA1 SHA512 SSDEEP

Submit Download

x5291614.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5291614.exe
Size 512KB
SHA256 3cf319cdf74033d4efedebfedd352c895e98da959cd7193884fe689ba8f92676
MD5 f831a94c71b3d897f99a79d0322513ba
SHA1 8a79247b4e565c723113193910b264a478c160a7
SHA512 bfaad376271aa6da183b2a044d3293acaf207d1463254572f68856d82ee195d3ba58761a273e2aa5fb057962d6a5b4524aa587aab102f90bb4a889c413256fe1
SSDEEP 12288:oMrsy90y+HfwtUEW1k7CF8rITJ1ZqegfnUwyS3Fwmtjh4wvnmsrcg:Uyqo3W1OA8kTJ1Zqegf9FVwmtewOsog
MD5 SHA1 SHA512 SSDEEP

Submit Download

x5291614.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5291614.exe
Size 512KB
SHA256 3cf319cdf74033d4efedebfedd352c895e98da959cd7193884fe689ba8f92676
MD5 f831a94c71b3d897f99a79d0322513ba
SHA1 8a79247b4e565c723113193910b264a478c160a7
SHA512 bfaad376271aa6da183b2a044d3293acaf207d1463254572f68856d82ee195d3ba58761a273e2aa5fb057962d6a5b4524aa587aab102f90bb4a889c413256fe1
SSDEEP 12288:oMrsy90y+HfwtUEW1k7CF8rITJ1ZqegfnUwyS3Fwmtjh4wvnmsrcg:Uyqo3W1OA8kTJ1Zqegf9FVwmtewOsog
MD5 SHA1 SHA512 SSDEEP

Submit Download

f6503608.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6503608.exe
Size 491KB
SHA256 8270321d7321fce2169815cc0e5313073e10274360d85976b482e693827e78a8
MD5 0953de60a7d5b103bc8c594759746aa6
SHA1 501ccda6972fe77806b0384cb6b7a769175b203e
SHA512 07decb3561278f26c12972756794837312955eb4bb03b5b9cb82f2c2d5a8b3e79b955a4e72637e0c84696972b4ae47cb88ea1aa8f28465af2ac7bd059dd4afdf
SSDEEP 6144:DTyzOmFaxdJhzdWqIe924O74fMyckoE0/J9K4swBnulY39l5vDYj/BI25GF:DTyzD0d/pO7+Mya/J9K4XFhUTBI2
MD5 SHA1 SHA512 SSDEEP

Submit Download

f6503608.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6503608.exe
Size 491KB
SHA256 8270321d7321fce2169815cc0e5313073e10274360d85976b482e693827e78a8
MD5 0953de60a7d5b103bc8c594759746aa6
SHA1 501ccda6972fe77806b0384cb6b7a769175b203e
SHA512 07decb3561278f26c12972756794837312955eb4bb03b5b9cb82f2c2d5a8b3e79b955a4e72637e0c84696972b4ae47cb88ea1aa8f28465af2ac7bd059dd4afdf
SSDEEP 6144:DTyzOmFaxdJhzdWqIe924O74fMyckoE0/J9K4swBnulY39l5vDYj/BI25GF:DTyzD0d/pO7+Mya/J9K4XFhUTBI2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4028-154-0x0000000001F60000-0x0000000001FEC000-memory.dmp

Download

memory/4028-155-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/4028-161-0x0000000074B00000-0x00000000752B0000-memory.dmp

Download

memory/4028-162-0x0000000001F60000-0x0000000001FEC000-memory.dmp

Download

memory/4028-163-0x0000000006C70000-0x0000000006C71000-memory.dmp

Download

memory/4028-164-0x0000000004B20000-0x0000000005138000-memory.dmp

Download

memory/4028-165-0x00000000051D0000-0x00000000052DA000-memory.dmp

Download

memory/4028-166-0x0000000006DF0000-0x0000000006E00000-memory.dmp

Download

memory/4028-167-0x0000000005300000-0x0000000005312000-memory.dmp

Download

memory/4028-168-0x0000000005320000-0x000000000535C000-memory.dmp

Download

memory/4028-169-0x0000000074B00000-0x00000000752B0000-memory.dmp

Download

memory/4028-170-0x0000000006DF0000-0x0000000006E00000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads