redline | 8a68d5e2cebc81b87ef22282e4eb9af0b0776fe47cb4a1e39aaed96f3b5fa171

Analysis

max time kernel
139s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2023, 07:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1256f708f701022984164fbee3ae9434.exe
Size 769KB
Sample230716-h2blesdf6y
SHA256 8a68d5e2cebc81b87ef22282e4eb9af0b0776fe47cb4a1e39aaed96f3b5fa171
MD5 1256f708f701022984164fbee3ae9434
SHA1 4c7032f4aea509e7dab6d37602c79e2478611936
SHA512 0b045b632fb716c67ceacf43bed145e119f540ebcf1b427a78f84ea6055377643ee0919f8cbad7ffd034afb2f444a9eda5f6ae127ffce89be0a774e170510917
SSDEEP 12288:8Mrsy90bwIM4l9soPBH8D0eRmQWnFQ3oas8VuA0Nb7+yZQvMou61+T:gyqZKcHM0ZnGYaxUA0Nbi+QkB61+T
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline lamp infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

lamp

77.91.68.56:19071

Attributes

auth_value
ee1df63bcdbe3de70f52810d94eaff7d

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
3316	x1200585.exe
4660	x5437816.exe
2436	g0536891.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	1256f708f701022984164fbee3ae9434.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	1256f708f701022984164fbee3ae9434.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x1200585.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x1200585.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x5437816.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x5437816.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 3316	2520	1256f708f701022984164fbee3ae9434.exe	83
PID 2520 wrote to memory of 3316	2520	1256f708f701022984164fbee3ae9434.exe	83
PID 2520 wrote to memory of 3316	2520	1256f708f701022984164fbee3ae9434.exe	83
PID 3316 wrote to memory of 4660	3316	x1200585.exe	84
PID 3316 wrote to memory of 4660	3316	x1200585.exe	84
PID 3316 wrote to memory of 4660	3316	x1200585.exe	84
PID 4660 wrote to memory of 2436	4660	x5437816.exe	85
PID 4660 wrote to memory of 2436	4660	x5437816.exe	85
PID 4660 wrote to memory of 2436	4660	x5437816.exe	85

C:\Users\Admin\AppData\Local\Temp\1256f708f701022984164fbee3ae9434.exe
"C:\Users\Admin\AppData\Local\Temp\1256f708f701022984164fbee3ae9434.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1200585.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1200585.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5437816.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5437816.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4660
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g0536891.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g0536891.exe
      4⤵
      Executes dropped EXE
      PID:2436

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x1200585.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1200585.exe
Size 613KB
SHA256 ccf88160200e2eef59471125da41cf531f00d6be48b568e48f89373a12f76a32
MD5 4b68535d9ae7b13cf3ff2f073670fb2d
SHA1 3ab1babe56d11fa75a053a052cc21eae84258cf6
SHA512 e7239d21f30c08b4676f08a26d5ecc6c469e9933fa3913039a9ab11c810c52c3599ee00bb4a660fdf1028736d48dd7fb05f8e7b04bfe663ff40b0596e5b98b76
SSDEEP 12288:+Mr1y90/IlEEw679VH/DYeRvQe0F03oasNVuA0WN7pKZrvl:zyIMwAnHbYe0CYaYUA0WNFmr9
MD5 SHA1 SHA512 SSDEEP

Submit Download

x1200585.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1200585.exe
Size 613KB
SHA256 ccf88160200e2eef59471125da41cf531f00d6be48b568e48f89373a12f76a32
MD5 4b68535d9ae7b13cf3ff2f073670fb2d
SHA1 3ab1babe56d11fa75a053a052cc21eae84258cf6
SHA512 e7239d21f30c08b4676f08a26d5ecc6c469e9933fa3913039a9ab11c810c52c3599ee00bb4a660fdf1028736d48dd7fb05f8e7b04bfe663ff40b0596e5b98b76
SSDEEP 12288:+Mr1y90/IlEEw679VH/DYeRvQe0F03oasNVuA0WN7pKZrvl:zyIMwAnHbYe0CYaYUA0WNFmr9
MD5 SHA1 SHA512 SSDEEP

Submit Download

x5437816.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5437816.exe
Size 512KB
SHA256 4343f9ba64b5d33cde391141404af6dbe47608e4fb6c56ff20c43a1c1329bf1a
MD5 32956c577b9a017f545b468acd8a5ae8
SHA1 b507c3abdcefdf7496d5e7548ffe076967f4a043
SHA512 fdec719616daeddf386e91c279430699a23debe9318a9717d940963b43b9175ae6bdfad1c17251f698769a30dd4466ff4a45854bd34784f9544f88f3476097df
SSDEEP 12288:4Mr8y90MhAd+tLXDRPQWlFxcoasyVuA0bu7AWXMtkR:0yO+3l31aPUA0buPX0w
MD5 SHA1 SHA512 SSDEEP

Submit Download

x5437816.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5437816.exe
Size 512KB
SHA256 4343f9ba64b5d33cde391141404af6dbe47608e4fb6c56ff20c43a1c1329bf1a
MD5 32956c577b9a017f545b468acd8a5ae8
SHA1 b507c3abdcefdf7496d5e7548ffe076967f4a043
SHA512 fdec719616daeddf386e91c279430699a23debe9318a9717d940963b43b9175ae6bdfad1c17251f698769a30dd4466ff4a45854bd34784f9544f88f3476097df
SSDEEP 12288:4Mr8y90MhAd+tLXDRPQWlFxcoasyVuA0bu7AWXMtkR:0yO+3l31aPUA0buPX0w
MD5 SHA1 SHA512 SSDEEP

Submit Download

g0536891.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g0536891.exe
Size 491KB
SHA256 29637e8c1a1ec7bffd145a7e2d3c0dd547d367d43c1a611fac2d21ebac4996b9
MD5 f172d470fc8f5a1f32456a418bcb6517
SHA1 7cedee0bcbcdb6ec4d0aa1c96cb781b58085c020
SHA512 f8f43a4c3ef3e7d0d79ad23ad29956d3a2c8d4e8bebbae7cdce7f0ca4ae5dd28408e3c0725ac65173a6b6bafb7c2b38e64f58b0339f4a4754eab76eadc21cc22
SSDEEP 6144:WquKbrmF6x/9n+Vh2MTvOfBwYSXW/SxZN2K4fGx0dAc4FHK4GqiNwB00/:VuKbck0h5OfB3QWAZwK4fGx0WLRH9
MD5 SHA1 SHA512 SSDEEP

Submit Download

g0536891.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g0536891.exe
Size 491KB
SHA256 29637e8c1a1ec7bffd145a7e2d3c0dd547d367d43c1a611fac2d21ebac4996b9
MD5 f172d470fc8f5a1f32456a418bcb6517
SHA1 7cedee0bcbcdb6ec4d0aa1c96cb781b58085c020
SHA512 f8f43a4c3ef3e7d0d79ad23ad29956d3a2c8d4e8bebbae7cdce7f0ca4ae5dd28408e3c0725ac65173a6b6bafb7c2b38e64f58b0339f4a4754eab76eadc21cc22
SSDEEP 6144:WquKbrmF6x/9n+Vh2MTvOfBwYSXW/SxZN2K4fGx0dAc4FHK4GqiNwB00/:VuKbck0h5OfB3QWAZwK4fGx0WLRH9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2436-154-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/2436-155-0x00000000006A0000-0x000000000072C000-memory.dmp

Download

memory/2436-161-0x0000000073CB0000-0x0000000074460000-memory.dmp

Download

memory/2436-162-0x00000000006A0000-0x000000000072C000-memory.dmp

Download

memory/2436-163-0x0000000006B30000-0x0000000006B31000-memory.dmp

Download

memory/2436-164-0x00000000049E0000-0x0000000004FF8000-memory.dmp

Download

memory/2436-165-0x0000000005090000-0x000000000519A000-memory.dmp

Download

memory/2436-166-0x00000000051C0000-0x00000000051D2000-memory.dmp

Download

memory/2436-167-0x0000000006BD0000-0x0000000006BE0000-memory.dmp

Download

memory/2436-168-0x00000000051E0000-0x000000000521C000-memory.dmp

Download

memory/2436-169-0x0000000073CB0000-0x0000000074460000-memory.dmp

Download

memory/2436-170-0x0000000006BD0000-0x0000000006BE0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads