redline | 2d6e35a8b02958db64fe8effa9804064bf478e88717fe23dabf9ee300706d032

Analysis

max time kernel
137s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2023, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ded856faaaf7204071d357ac2e4bd482.exe
Size 769KB
Sample230716-jfvb3sda77
SHA256 2d6e35a8b02958db64fe8effa9804064bf478e88717fe23dabf9ee300706d032
MD5 ded856faaaf7204071d357ac2e4bd482
SHA1 b071d4af706f6a29ca6ab2605a8f12810e007fa7
SHA512 f93f89eca65ec46487d5e8352ca3fe3954f582041ae2fa47b0de350059922109c86903bd5b1b11b3d796f96eaa6b1a2412a50dc623afcbf78df1e0fa72c80634
SSDEEP 24576:6yDlHqDvPmZYr6+Udd48cxFVbW2qL0xtc3h716b:BDLuHUdd48QFVrc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline lamp infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

lamp

77.91.68.56:19071

Attributes

auth_value
ee1df63bcdbe3de70f52810d94eaff7d

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
1692	x2202713.exe
4568	x6896964.exe
2040	g1683404.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ded856faaaf7204071d357ac2e4bd482.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ded856faaaf7204071d357ac2e4bd482.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x2202713.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x2202713.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x6896964.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x6896964.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{A97055FA-3AA7-46C1-825F-101F0847C4FA}.catalogItem	svchost.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 1692	1748	ded856faaaf7204071d357ac2e4bd482.exe	90
PID 1748 wrote to memory of 1692	1748	ded856faaaf7204071d357ac2e4bd482.exe	90
PID 1748 wrote to memory of 1692	1748	ded856faaaf7204071d357ac2e4bd482.exe	90
PID 1692 wrote to memory of 4568	1692	x2202713.exe	91
PID 1692 wrote to memory of 4568	1692	x2202713.exe	91
PID 1692 wrote to memory of 4568	1692	x2202713.exe	91
PID 4568 wrote to memory of 2040	4568	x6896964.exe	92
PID 4568 wrote to memory of 2040	4568	x6896964.exe	92
PID 4568 wrote to memory of 2040	4568	x6896964.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ded856faaaf7204071d357ac2e4bd482.exe
"C:\Users\Admin\AppData\Local\Temp\ded856faaaf7204071d357ac2e4bd482.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2202713.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2202713.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6896964.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6896964.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4568
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g1683404.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g1683404.exe
      4⤵
      Executes dropped EXE
      PID:2040

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:3892

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x2202713.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2202713.exe
Size 613KB
SHA256 b9d7e1e45e73aa4de4f81d36fd780983255e23447acc239428269c08729c4522
MD5 73adb0bdf5bfd43e75256927d784195d
SHA1 a1f440c9cb7fb506fa9244ccf4cfa3c4baf08beb
SHA512 c98b887d140c572e9fbb9a8986e6f00c556accabc655dbabe7835e3cac155f995626345435c3b8059084ade37552e8775544c7808e4a54c96f0df08bf6a2566a
SSDEEP 12288:fMrfy90TYpdlKwqO6+Nd5HWv4kHcOA/s8CkOgp2eabVZLQGjie+g:oyi46+Ndu40cOF8bV2xLQG2eD
MD5 SHA1 SHA512 SSDEEP

Submit Download

x2202713.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2202713.exe
Size 613KB
SHA256 b9d7e1e45e73aa4de4f81d36fd780983255e23447acc239428269c08729c4522
MD5 73adb0bdf5bfd43e75256927d784195d
SHA1 a1f440c9cb7fb506fa9244ccf4cfa3c4baf08beb
SHA512 c98b887d140c572e9fbb9a8986e6f00c556accabc655dbabe7835e3cac155f995626345435c3b8059084ade37552e8775544c7808e4a54c96f0df08bf6a2566a
SSDEEP 12288:fMrfy90TYpdlKwqO6+Nd5HWv4kHcOA/s8CkOgp2eabVZLQGjie+g:oyi46+Ndu40cOF8bV2xLQG2eD
MD5 SHA1 SHA512 SSDEEP

Submit Download

x6896964.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6896964.exe
Size 512KB
SHA256 a58ebf0ea02941cba53bb03fb63b7a1b20d1850ebd4386c64d5829cc95a916cd
MD5 9c6e069dca9734881baf2f8cec7d8d59
SHA1 a85b5779815b0a8bcd7cade717d0d3bf54c612df
SHA512 03bebdfcb0de770a367a14e53e528ded99f39019f85dc1e3aacd702799a47668dbd4577eb058cf80f32fac6b908ea76d6fc8a23a93207d482ed79ca3a872593c
SSDEEP 12288:XMrty90sYIK4pQQOSoQ7kOcOA/sWCkOgc2eabQuLQM7k6+O:WybYwpQQOc7pcOFWbA2zLQMQ6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

x6896964.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6896964.exe
Size 512KB
SHA256 a58ebf0ea02941cba53bb03fb63b7a1b20d1850ebd4386c64d5829cc95a916cd
MD5 9c6e069dca9734881baf2f8cec7d8d59
SHA1 a85b5779815b0a8bcd7cade717d0d3bf54c612df
SHA512 03bebdfcb0de770a367a14e53e528ded99f39019f85dc1e3aacd702799a47668dbd4577eb058cf80f32fac6b908ea76d6fc8a23a93207d482ed79ca3a872593c
SSDEEP 12288:XMrty90sYIK4pQQOSoQ7kOcOA/sWCkOgc2eabQuLQM7k6+O:WybYwpQQOc7pcOFWbA2zLQMQ6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

g1683404.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g1683404.exe
Size 489KB
SHA256 49c1e82db1b91686cc793e61f29d4d1a2d0d8c2c96e9a07d0eb1a490b2d93a0e
MD5 00d1a44014b59cb10ae292287629df8e
SHA1 c1d75781e9229b4fbba70927903b7922e4501aba
SHA512 41883846ef7107cfcc5cc97f688a13a4b5096f597120a865d36e0b61e19413cbc1c44d6167c91d55257a8ee063be04acfbbb51d0f4722d5d7ec9f54bd15e5125
SSDEEP 12288:X+bcJXmg65no7k2cOA/ZLK42q3u5LKFB1yGd:XH7BcOGK42jqB
MD5 SHA1 SHA512 SSDEEP

Submit Download

g1683404.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g1683404.exe
Size 489KB
SHA256 49c1e82db1b91686cc793e61f29d4d1a2d0d8c2c96e9a07d0eb1a490b2d93a0e
MD5 00d1a44014b59cb10ae292287629df8e
SHA1 c1d75781e9229b4fbba70927903b7922e4501aba
SHA512 41883846ef7107cfcc5cc97f688a13a4b5096f597120a865d36e0b61e19413cbc1c44d6167c91d55257a8ee063be04acfbbb51d0f4722d5d7ec9f54bd15e5125
SSDEEP 12288:X+bcJXmg65no7k2cOA/ZLK42q3u5LKFB1yGd:XH7BcOGK42jqB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2040-164-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/2040-165-0x0000000001FD0000-0x000000000205C000-memory.dmp

Download

memory/2040-171-0x0000000074700000-0x0000000074EB0000-memory.dmp

Download

memory/2040-172-0x0000000001FD0000-0x000000000205C000-memory.dmp

Download

memory/2040-173-0x00000000024F0000-0x00000000024F1000-memory.dmp

Download

memory/2040-174-0x0000000005150000-0x0000000005768000-memory.dmp

Download

memory/2040-175-0x0000000004BC0000-0x0000000004CCA000-memory.dmp

Download

memory/2040-176-0x0000000004CF0000-0x0000000004D02000-memory.dmp

Download

memory/2040-177-0x0000000074700000-0x0000000074EB0000-memory.dmp

Download

memory/2040-178-0x0000000006E00000-0x0000000006E10000-memory.dmp

Download

memory/2040-179-0x0000000004D10000-0x0000000004D4C000-memory.dmp

Download

memory/2040-180-0x0000000006E00000-0x0000000006E10000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads