redline | a09d74896b2bf4b85f4cea6e5191509aeb62cbb8486c808066691cfdf1e945a2

Analysis

max time kernel
137s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2023, 07:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a5ef4b454e5346949af9f4a435285ba2.exe
Size 770KB
Sample230716-jc28hsda34
SHA256 a09d74896b2bf4b85f4cea6e5191509aeb62cbb8486c808066691cfdf1e945a2
MD5 a5ef4b454e5346949af9f4a435285ba2
SHA1 da0468e8ebf7d0e750450827301a8b81b40ce095
SHA512 510a1152ece09f9ea6a6a5d2768bde2a015d0ba1f142da64ba53e55b5213bb0d919046366e431c7b4a7fa40492bc2f647748474257b152ac1d338bd957e2005c
SSDEEP 12288:cMr2y90gLSQziXjFnMA9m1DqsHMb3QSdoxxr3jk3GZwwj5boXV6RwGkdDgaF7uz:6yzS1jSA9usb31ohd6XV6iGkd/uz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline lamp infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

lamp

77.91.68.56:19071

Attributes

auth_value
ee1df63bcdbe3de70f52810d94eaff7d

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
3040	x5661043.exe
3748	x8518354.exe
2884	g1590321.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	a5ef4b454e5346949af9f4a435285ba2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a5ef4b454e5346949af9f4a435285ba2.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x5661043.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x5661043.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x8518354.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x8518354.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 3040	4452	a5ef4b454e5346949af9f4a435285ba2.exe	85
PID 4452 wrote to memory of 3040	4452	a5ef4b454e5346949af9f4a435285ba2.exe	85
PID 4452 wrote to memory of 3040	4452	a5ef4b454e5346949af9f4a435285ba2.exe	85
PID 3040 wrote to memory of 3748	3040	x5661043.exe	86
PID 3040 wrote to memory of 3748	3040	x5661043.exe	86
PID 3040 wrote to memory of 3748	3040	x5661043.exe	86
PID 3748 wrote to memory of 2884	3748	x8518354.exe	87
PID 3748 wrote to memory of 2884	3748	x8518354.exe	87
PID 3748 wrote to memory of 2884	3748	x8518354.exe	87

C:\Users\Admin\AppData\Local\Temp\a5ef4b454e5346949af9f4a435285ba2.exe
"C:\Users\Admin\AppData\Local\Temp\a5ef4b454e5346949af9f4a435285ba2.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5661043.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5661043.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x8518354.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x8518354.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3748
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g1590321.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g1590321.exe
      4⤵
      Executes dropped EXE
      PID:2884

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x5661043.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5661043.exe
Size 615KB
SHA256 1a1a77187a29047f371097e1b5906ce4ac100c75c400de36b083f6142a381bc7
MD5 5554c089e1a2a2a13d351546bc3e0308
SHA1 b1dc673b422f62d887713beb6a4b6e83a0803ded
SHA512 c3b9c3a3147ba6ce9ca943d3b625603bbb6881ce90d3dd79ed8c90b65400b96203c7614bb067f6e20128dad04894437d6503b29f0817e1b08162416c2ee28d9c
SSDEEP 12288:6Mrvy90fn3OHo9tJ3L13YZPDBJILiVvRBGkoM:tyYn3OGb+IiVvDGkoM
MD5 SHA1 SHA512 SSDEEP

Submit Download

x5661043.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5661043.exe
Size 615KB
SHA256 1a1a77187a29047f371097e1b5906ce4ac100c75c400de36b083f6142a381bc7
MD5 5554c089e1a2a2a13d351546bc3e0308
SHA1 b1dc673b422f62d887713beb6a4b6e83a0803ded
SHA512 c3b9c3a3147ba6ce9ca943d3b625603bbb6881ce90d3dd79ed8c90b65400b96203c7614bb067f6e20128dad04894437d6503b29f0817e1b08162416c2ee28d9c
SSDEEP 12288:6Mrvy90fn3OHo9tJ3L13YZPDBJILiVvRBGkoM:tyYn3OGb+IiVvDGkoM
MD5 SHA1 SHA512 SSDEEP

Submit Download

x8518354.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x8518354.exe
Size 513KB
SHA256 d752b39adfbf1c88c21a5a0aad42b10a2c60835037342c1f98d984633cad3eb3
MD5 6fd254a65a3f7fc4b5571de3fad4335d
SHA1 470a6d708b19eba853ff961bea0a590b789eb338
SHA512 a22cea0a0e12ade093120bc3c2deca97d029cfb856e25131dd4d1a8c7a54213df9af8a7acc9c6b9372ab5a3df8cf38cd64fb2db0e3837480a59641198f10992c
SSDEEP 12288:bMrGy90fwRHbE3w1tzZ5MVJjxiVKy/GkM:JyGwRyQyiVKMGkM
MD5 SHA1 SHA512 SSDEEP

Submit Download

x8518354.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x8518354.exe
Size 513KB
SHA256 d752b39adfbf1c88c21a5a0aad42b10a2c60835037342c1f98d984633cad3eb3
MD5 6fd254a65a3f7fc4b5571de3fad4335d
SHA1 470a6d708b19eba853ff961bea0a590b789eb338
SHA512 a22cea0a0e12ade093120bc3c2deca97d029cfb856e25131dd4d1a8c7a54213df9af8a7acc9c6b9372ab5a3df8cf38cd64fb2db0e3837480a59641198f10992c
SSDEEP 12288:bMrGy90fwRHbE3w1tzZ5MVJjxiVKy/GkM:JyGwRyQyiVKMGkM
MD5 SHA1 SHA512 SSDEEP

Submit Download

g1590321.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g1590321.exe
Size 491KB
SHA256 3aa55b668214c8677849adaeade35d12c0f9349d0b4546368f5fca7b239883b9
MD5 1ee39421b3448e6bf931ade6314bb8f1
SHA1 d9061d1243f50564b0939f1281a2672e3cb6864f
SHA512 e17eacce1bd2e135c52b892c2c12de2913f53ed2a9c12b125b7f4973b82a9bb5d15a717760fca8394732b8b530d315df2940c071a7a365d22518a96b815c456b
SSDEEP 12288:0jlLUXSDoogG1tzcZwK4g07NIX8sGgBRC4he6v11I5DT:0KCHb3K4MVK4he645P
MD5 SHA1 SHA512 SSDEEP

Submit Download

g1590321.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g1590321.exe
Size 491KB
SHA256 3aa55b668214c8677849adaeade35d12c0f9349d0b4546368f5fca7b239883b9
MD5 1ee39421b3448e6bf931ade6314bb8f1
SHA1 d9061d1243f50564b0939f1281a2672e3cb6864f
SHA512 e17eacce1bd2e135c52b892c2c12de2913f53ed2a9c12b125b7f4973b82a9bb5d15a717760fca8394732b8b530d315df2940c071a7a365d22518a96b815c456b
SSDEEP 12288:0jlLUXSDoogG1tzcZwK4g07NIX8sGgBRC4he6v11I5DT:0KCHb3K4MVK4he645P
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2884-155-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/2884-154-0x0000000002020000-0x00000000020AC000-memory.dmp

Download

memory/2884-161-0x0000000073DA0000-0x0000000074550000-memory.dmp

Download

memory/2884-162-0x0000000002020000-0x00000000020AC000-memory.dmp

Download

memory/2884-163-0x00000000024A0000-0x00000000024A1000-memory.dmp

Download

memory/2884-164-0x0000000006E00000-0x0000000007418000-memory.dmp

Download

memory/2884-165-0x0000000007440000-0x000000000754A000-memory.dmp

Download

memory/2884-167-0x0000000006CF0000-0x0000000006D00000-memory.dmp

Download

memory/2884-166-0x0000000007570000-0x0000000007582000-memory.dmp

Download

memory/2884-168-0x0000000007590000-0x00000000075CC000-memory.dmp

Download

memory/2884-169-0x0000000073DA0000-0x0000000074550000-memory.dmp

Download

memory/2884-170-0x0000000006CF0000-0x0000000006D00000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads