redline | 846dda125569eeb29c3dfe43747dd0a19bebf5677772c54ec7fda44aebadfda8

Analysis

max time kernel
154s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2023, 07:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fd7d1d6d7e37d42f7fde59ea1d5600e5.exe
Size 771KB
Sample230716-jj9aeadb44
SHA256 846dda125569eeb29c3dfe43747dd0a19bebf5677772c54ec7fda44aebadfda8
MD5 fd7d1d6d7e37d42f7fde59ea1d5600e5
SHA1 27f42411c4ff2a44dce981e113090b4298024528
SHA512 c42be51cc420d630f29e710349e086609939284725eb90468f4a2d2789e374eedc6d7da6097508fb44efa1c5ee4db633b5be9b1d0613ab951f0194c4838fe61a
SSDEEP 12288:6MrQy90eHdaxClb+ew4Cf7wVc9kFLwSPiS5tBkytB3RU1XMSYcXIP/sWdlkx:eytax3z4EU8CLwSPiSjBLAXMze
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline lamp infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

lamp

77.91.68.56:19071

Attributes

auth_value
ee1df63bcdbe3de70f52810d94eaff7d

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 3 IoCs

pid	Process
4736	x3265521.exe
3268	x6722163.exe
3668	g3869087.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	fd7d1d6d7e37d42f7fde59ea1d5600e5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	fd7d1d6d7e37d42f7fde59ea1d5600e5.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x3265521.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x3265521.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x6722163.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x6722163.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 4736	2752	fd7d1d6d7e37d42f7fde59ea1d5600e5.exe	86
PID 2752 wrote to memory of 4736	2752	fd7d1d6d7e37d42f7fde59ea1d5600e5.exe	86
PID 2752 wrote to memory of 4736	2752	fd7d1d6d7e37d42f7fde59ea1d5600e5.exe	86
PID 4736 wrote to memory of 3268	4736	x3265521.exe	87
PID 4736 wrote to memory of 3268	4736	x3265521.exe	87
PID 4736 wrote to memory of 3268	4736	x3265521.exe	87
PID 3268 wrote to memory of 3668	3268	x6722163.exe	88
PID 3268 wrote to memory of 3668	3268	x6722163.exe	88
PID 3268 wrote to memory of 3668	3268	x6722163.exe	88

C:\Users\Admin\AppData\Local\Temp\fd7d1d6d7e37d42f7fde59ea1d5600e5.exe
"C:\Users\Admin\AppData\Local\Temp\fd7d1d6d7e37d42f7fde59ea1d5600e5.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3265521.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3265521.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6722163.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6722163.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3268
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g3869087.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g3869087.exe
      4⤵
      Executes dropped EXE
      PID:3668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x3265521.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3265521.exe
Size 616KB
SHA256 9f447f5df40480a1439052cce474f36f9803fb478275434f2b9393a35ebe93ac
MD5 d6ba9d7c1578ebdea19d073cc38ebb37
SHA1 04864c7a96765b3c2b30b7180139cce9c3a98bd3
SHA512 afe3544fb0a3b8fc0170ebdb91b233e753dcf72c42e0fcba9ed323f889f060b70a7c3d14aea1f10f10f76c9974a433772164936b4bbd0afcce50a424fe8266fe
SSDEEP 12288:aMrJy903yD9Vc9pXLzYPiSdyBcyXBeRW5XaPYgXOPF:TyD98hLzYPiS0B9pXaAH
MD5 SHA1 SHA512 SSDEEP

Submit Download

x3265521.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3265521.exe
Size 616KB
SHA256 9f447f5df40480a1439052cce474f36f9803fb478275434f2b9393a35ebe93ac
MD5 d6ba9d7c1578ebdea19d073cc38ebb37
SHA1 04864c7a96765b3c2b30b7180139cce9c3a98bd3
SHA512 afe3544fb0a3b8fc0170ebdb91b233e753dcf72c42e0fcba9ed323f889f060b70a7c3d14aea1f10f10f76c9974a433772164936b4bbd0afcce50a424fe8266fe
SSDEEP 12288:aMrJy903yD9Vc9pXLzYPiSdyBcyXBeRW5XaPYgXOPF:TyD98hLzYPiS0B9pXaAH
MD5 SHA1 SHA512 SSDEEP

Submit Download

x6722163.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6722163.exe
Size 514KB
SHA256 ceda9f3d9ee7dcd50f103084f74a6adc19a15e68c8cd0e2f7913074493f986d1
MD5 ac7d67f76a04087e6c39601d19c7ec9c
SHA1 f83ca29e63aad181c08f0161aa4a1e0188c3c69b
SHA512 66f0fbc895e3fea90c51364ad7f28ecfc36d05bc63f89fa745912d5cdd0ee1ecfd82760853416a706f20fdef9f709b7073785540f0025dfadccb030b87616779
SSDEEP 12288:0Mrsy900WrQL0viSfoB3ycBesvdXaUdeJLuCh:IyjfLSiSQBnzXaweJKe
MD5 SHA1 SHA512 SSDEEP

Submit Download

x6722163.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6722163.exe
Size 514KB
SHA256 ceda9f3d9ee7dcd50f103084f74a6adc19a15e68c8cd0e2f7913074493f986d1
MD5 ac7d67f76a04087e6c39601d19c7ec9c
SHA1 f83ca29e63aad181c08f0161aa4a1e0188c3c69b
SHA512 66f0fbc895e3fea90c51364ad7f28ecfc36d05bc63f89fa745912d5cdd0ee1ecfd82760853416a706f20fdef9f709b7073785540f0025dfadccb030b87616779
SSDEEP 12288:0Mrsy900WrQL0viSfoB3ycBesvdXaUdeJLuCh:IyjfLSiSQBnzXaweJKe
MD5 SHA1 SHA512 SSDEEP

Submit Download

g3869087.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g3869087.exe
Size 491KB
SHA256 3dcfd4773a0498fcbf8b3b0c9584c5cb08476c49684ede7b426c944c05c3cc1f
MD5 8dd13b2f1861787b5b3e123fc6ec4ee4
SHA1 013875af43b3cd83ba6e10c4e725fb3a7a5d51f5
SHA512 475af7d31455ac6137f920fff966742c7c51b61801279265e4d680d9d3c64d012b219d629320f3dddb317a4ca82c1eebd01996d46ee29a5363c10861db00c7aa
SSDEEP 12288:s/pbcf3YFjz/ZuK4S8cAp8d0Mr6h9c6B:sO3gj7gK4S8lpTk6
MD5 SHA1 SHA512 SSDEEP

Submit Download

g3869087.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g3869087.exe
Size 491KB
SHA256 3dcfd4773a0498fcbf8b3b0c9584c5cb08476c49684ede7b426c944c05c3cc1f
MD5 8dd13b2f1861787b5b3e123fc6ec4ee4
SHA1 013875af43b3cd83ba6e10c4e725fb3a7a5d51f5
SHA512 475af7d31455ac6137f920fff966742c7c51b61801279265e4d680d9d3c64d012b219d629320f3dddb317a4ca82c1eebd01996d46ee29a5363c10861db00c7aa
SSDEEP 12288:s/pbcf3YFjz/ZuK4S8cAp8d0Mr6h9c6B:sO3gj7gK4S8lpTk6
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3668-155-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/3668-154-0x0000000001FE0000-0x000000000206C000-memory.dmp

Download

memory/3668-161-0x00000000749F0000-0x00000000751A0000-memory.dmp

Download

memory/3668-162-0x0000000001FE0000-0x000000000206C000-memory.dmp

Download

memory/3668-163-0x00000000024A0000-0x00000000024A1000-memory.dmp

Download

memory/3668-164-0x0000000004A20000-0x0000000005038000-memory.dmp

Download

memory/3668-165-0x00000000050B0000-0x00000000051BA000-memory.dmp

Download

memory/3668-166-0x00000000051E0000-0x00000000051F2000-memory.dmp

Download

memory/3668-167-0x0000000006D40000-0x0000000006D50000-memory.dmp

Download

memory/3668-168-0x0000000005200000-0x000000000523C000-memory.dmp

Download

memory/3668-169-0x00000000749F0000-0x00000000751A0000-memory.dmp

Download

memory/3668-170-0x0000000006D40000-0x0000000006D50000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads