redline | f4b9da5e164af42ab38f095a23decf8883550ff0ca21c0e91d15402d44cbabac

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2023, 07:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4df77494c18ffd3c9189891f14dedf6a.exe
Size 771KB
Sample230716-jabyjsch78
SHA256 f4b9da5e164af42ab38f095a23decf8883550ff0ca21c0e91d15402d44cbabac
MD5 4df77494c18ffd3c9189891f14dedf6a
SHA1 766053a6bc07a2ce7d8d091df44fb552a1ca66e1
SHA512 787366805b6e4efd28a89d7407bd3701b8f77d95f9e8d3781cc7acc9cfd4148619d75b8a65cf7dd525ea9591c483a6fdc3eb905fa84f069c159b70eb45b7ea33
SSDEEP 12288:8Mr0y90gRwk7ZSN04JYLnXht3ObvYEfeCRpWDvsCkJzi9tT8NxNFGVX:Iy751mgLnXhI7DfeCRpwhkJzwF8NxKp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline lamp infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

lamp

77.91.68.56:19071

Attributes

auth_value
ee1df63bcdbe3de70f52810d94eaff7d

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
4844	x1764344.exe
2112	x4894706.exe
1660	g6333685.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	4df77494c18ffd3c9189891f14dedf6a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	4df77494c18ffd3c9189891f14dedf6a.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x1764344.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x1764344.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x4894706.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x4894706.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 4844	4884	4df77494c18ffd3c9189891f14dedf6a.exe	85
PID 4884 wrote to memory of 4844	4884	4df77494c18ffd3c9189891f14dedf6a.exe	85
PID 4884 wrote to memory of 4844	4884	4df77494c18ffd3c9189891f14dedf6a.exe	85
PID 4844 wrote to memory of 2112	4844	x1764344.exe	86
PID 4844 wrote to memory of 2112	4844	x1764344.exe	86
PID 4844 wrote to memory of 2112	4844	x1764344.exe	86
PID 2112 wrote to memory of 1660	2112	x4894706.exe	87
PID 2112 wrote to memory of 1660	2112	x4894706.exe	87
PID 2112 wrote to memory of 1660	2112	x4894706.exe	87

C:\Users\Admin\AppData\Local\Temp\4df77494c18ffd3c9189891f14dedf6a.exe
"C:\Users\Admin\AppData\Local\Temp\4df77494c18ffd3c9189891f14dedf6a.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1764344.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1764344.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4894706.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4894706.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2112
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g6333685.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g6333685.exe
      4⤵
      Executes dropped EXE
      PID:1660

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x1764344.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1764344.exe
Size 616KB
SHA256 e98ff8ad368484d8d9d0a4c975fe8bb7a58cc6f61de8eed6a3ee7fcb6667b752
MD5 82e07d5f2e4128d698eb1637d0a0b40a
SHA1 42ed0aacfd3ed6d9282f37a4cc1651d6810f4284
SHA512 8d5c460264efda3d4178c980949f9515f5c05c9de49561c5c659da382d3150cbeddc695c9b424ba8fa834702352d0c1f8de75fd22d708721a47096090308ebad
SSDEEP 12288:ZMrGy90pwHYDYtPFVbnXht3eAvYHfa9BpedIs7GuPi1tTkNT:Tyw+tPrbnXhA6cfa9BprQGuPYFkNT
MD5 SHA1 SHA512 SSDEEP

Submit Download

x1764344.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1764344.exe
Size 616KB
SHA256 e98ff8ad368484d8d9d0a4c975fe8bb7a58cc6f61de8eed6a3ee7fcb6667b752
MD5 82e07d5f2e4128d698eb1637d0a0b40a
SHA1 42ed0aacfd3ed6d9282f37a4cc1651d6810f4284
SHA512 8d5c460264efda3d4178c980949f9515f5c05c9de49561c5c659da382d3150cbeddc695c9b424ba8fa834702352d0c1f8de75fd22d708721a47096090308ebad
SSDEEP 12288:ZMrGy90pwHYDYtPFVbnXht3eAvYHfa9BpedIs7GuPi1tTkNT:Tyw+tPrbnXhA6cfa9BprQGuPYFkNT
MD5 SHA1 SHA512 SSDEEP

Submit Download

x4894706.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4894706.exe
Size 515KB
SHA256 7e7d5457b7dbbb17885fb81d506c3abcff9d49256788c889343d28b138994340
MD5 1e807f91a307ef0b30388b05d4160718
SHA1 53d16bbd7890c4277811a53fdd130c10a0c670bb
SHA512 146b00d324d5f8b73b741e9e5fdd1f5d0c3a9dc2913d192d81bea615d2dbc82ed8f6e50f733e687b99c6ec89ad295f37616a26ff0443cb591e57a39b2872666e
SSDEEP 12288:dMrmy90c6HNf39vLRd1VIqlPi9WJw+mr:Pyd6HNf39vLVqqlPAWC
MD5 SHA1 SHA512 SSDEEP

Submit Download

x4894706.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4894706.exe
Size 515KB
SHA256 7e7d5457b7dbbb17885fb81d506c3abcff9d49256788c889343d28b138994340
MD5 1e807f91a307ef0b30388b05d4160718
SHA1 53d16bbd7890c4277811a53fdd130c10a0c670bb
SHA512 146b00d324d5f8b73b741e9e5fdd1f5d0c3a9dc2913d192d81bea615d2dbc82ed8f6e50f733e687b99c6ec89ad295f37616a26ff0443cb591e57a39b2872666e
SSDEEP 12288:dMrmy90c6HNf39vLRd1VIqlPi9WJw+mr:Pyd6HNf39vLVqqlPAWC
MD5 SHA1 SHA512 SSDEEP

Submit Download

g6333685.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g6333685.exe
Size 491KB
SHA256 8c512de7676e5771ac83fe8a04b75a22ae1f91af598ea01bc3020711ffd3984c
MD5 b2018a385481895dd8dcb71d49f4f2a2
SHA1 9688c204322b073a9dac3c7238d3be9b7be45059
SHA512 e081c8fa859901d176cb4359836b5c9cfdfc38460dd052f6b7b92c83511f0764217320d7d92adbbe6055748a5879b0b74d28a54ed2e884804c213590ecf941c7
SSDEEP 6144:g0oialGmFaxvBE2xbk5CauCxhd7tTxJ4jWK4xQ0TG32Uakz+9qPqLxskg:aialLG+TLHd6WK46Y2LZYxsk
MD5 SHA1 SHA512 SSDEEP

Submit Download

g6333685.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g6333685.exe
Size 491KB
SHA256 8c512de7676e5771ac83fe8a04b75a22ae1f91af598ea01bc3020711ffd3984c
MD5 b2018a385481895dd8dcb71d49f4f2a2
SHA1 9688c204322b073a9dac3c7238d3be9b7be45059
SHA512 e081c8fa859901d176cb4359836b5c9cfdfc38460dd052f6b7b92c83511f0764217320d7d92adbbe6055748a5879b0b74d28a54ed2e884804c213590ecf941c7
SSDEEP 6144:g0oialGmFaxvBE2xbk5CauCxhd7tTxJ4jWK4xQ0TG32Uakz+9qPqLxskg:aialLG+TLHd6WK46Y2LZYxsk
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1660-154-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1660-155-0x0000000001FE0000-0x000000000206C000-memory.dmp

Download

memory/1660-161-0x0000000074370000-0x0000000074B20000-memory.dmp

Download

memory/1660-162-0x0000000001FE0000-0x000000000206C000-memory.dmp

Download

memory/1660-163-0x0000000006B30000-0x0000000006B31000-memory.dmp

Download

memory/1660-164-0x0000000005000000-0x0000000005618000-memory.dmp

Download

memory/1660-165-0x0000000004A70000-0x0000000004B7A000-memory.dmp

Download

memory/1660-167-0x0000000006CC0000-0x0000000006CD0000-memory.dmp

Download

memory/1660-166-0x0000000004BA0000-0x0000000004BB2000-memory.dmp

Download

memory/1660-168-0x0000000004BC0000-0x0000000004BFC000-memory.dmp

Download

memory/1660-169-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1660-170-0x0000000074370000-0x0000000074B20000-memory.dmp

Download

memory/1660-171-0x0000000006CC0000-0x0000000006CD0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads