redline | 57a34a1caae7f0426b32bc71b73785f820451c97d3c5db368da479183b037629

Analysis

max time kernel
143s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 17:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cceb3dc1a54d4e14e7b2dac2489e5cd6194c0f51b064f6e726229fb798deb20e.exe
Size

768KB
MD5

6029b53a99c95c89f05348134130ef59
SHA1

8bed0b5da45422d839446df8f87dec514b88b848
SHA256

cceb3dc1a54d4e14e7b2dac2489e5cd6194c0f51b064f6e726229fb798deb20e
SHA512

40d170992d9663f56577d2f75d609600c25d001bc7bea2854016da37f0e4020cada096c623e47dd3315d797c65d762ad181c604e659c61a03942c10745c6de76
SSDEEP

12288:1MrOy90ds4JKIlZCuYpzqJ8x0KfiaI/e1lDsyCPLVD+trmFGEkh4aWF:LyAkgC0pKVIIDUPhCtrmFk4RF

Score

10^/10

redline lamp infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

lamp

77.91.68.56:19071

Attributes

auth_value
ee1df63bcdbe3de70f52810d94eaff7d

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral23/memory/4980-23-0x0000000001F60000-0x0000000001FEC000-memory.dmp	family_redline
behavioral23/memory/4980-28-0x0000000001F60000-0x0000000001FEC000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

pid	Process
4036	x4682297.exe
220	x1802191.exe
4980	g2449513.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	cceb3dc1a54d4e14e7b2dac2489e5cd6194c0f51b064f6e726229fb798deb20e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x4682297.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x1802191.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3636 wrote to memory of 4036	3636	cceb3dc1a54d4e14e7b2dac2489e5cd6194c0f51b064f6e726229fb798deb20e.exe	83
PID 3636 wrote to memory of 4036	3636	cceb3dc1a54d4e14e7b2dac2489e5cd6194c0f51b064f6e726229fb798deb20e.exe	83
PID 3636 wrote to memory of 4036	3636	cceb3dc1a54d4e14e7b2dac2489e5cd6194c0f51b064f6e726229fb798deb20e.exe	83
PID 4036 wrote to memory of 220	4036	x4682297.exe	84
PID 4036 wrote to memory of 220	4036	x4682297.exe	84
PID 4036 wrote to memory of 220	4036	x4682297.exe	84
PID 220 wrote to memory of 4980	220	x1802191.exe	86
PID 220 wrote to memory of 4980	220	x1802191.exe	86
PID 220 wrote to memory of 4980	220	x1802191.exe	86

C:\Users\Admin\AppData\Local\Temp\cceb3dc1a54d4e14e7b2dac2489e5cd6194c0f51b064f6e726229fb798deb20e.exe
"C:\Users\Admin\AppData\Local\Temp\cceb3dc1a54d4e14e7b2dac2489e5cd6194c0f51b064f6e726229fb798deb20e.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4682297.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4682297.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4036
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1802191.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1802191.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:220
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g2449513.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g2449513.exe
      4⤵
      Executes dropped EXE
      PID:4980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4682297.exe

Filesize
612KB

MD5
d081767b3ebd2d7a9f764ffdc139b168

SHA1
324dad2bd1bcb73d4a86a95b9cfc80eb72f1c13f

SHA256
1a1bf62585b043a497f850e2097e2c2c302220b510ac659141202b160b406dba

SHA512
64fd3d036809f81a37021617148aaf59edf58c8b34d61cff6014d32a672a3c9b6443dbb972ff82b9222516852a51bd7eab4058c0486d1c53d8dfdc64022c85ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1802191.exe

Filesize
511KB

MD5
1be061f2129856d382bdd733e29d650d

SHA1
c4fb0dcb3492572568a006a780330bcd923b6fdd

SHA256
5d7ecfa5673031117f93ed47b53a3cd36d6b89e9a74cbb4ada57112be8d69ed7

SHA512
4ee268d6358592c1bdd78c56adcb94f6fdfa83333519e762860a1032d2578292a07fd8efc9b492ca08523fdd7e95bce27249d7bf9ccf5b45da01e3409c0423f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g2449513.exe

Filesize
489KB

MD5
17d5bd158552db313dbb6baa180c8473

SHA1
cbe14bf1767f5589b1923a0d4c1be1fd54292ae3

SHA256
d139a831bbd93c34c0a0e69bc443c5de93ba54dd39bfa4301cc6314d0e8d8352

SHA512
2f1a8c10ca00b75cdaa9255254988926390c48950f2e8dc85aaca875e9ca9d41c24797c76c584f750f51f072692f1c7dcec3e58a3825663a7a640b926a21d3f4

Download Submit
memory/4980-22-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download
memory/4980-23-0x0000000001F60000-0x0000000001FEC000-memory.dmp

Filesize
560KB

Download
memory/4980-28-0x0000000001F60000-0x0000000001FEC000-memory.dmp

Filesize
560KB

Download
memory/4980-29-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/4980-30-0x00000000024D0000-0x00000000024D6000-memory.dmp

Filesize
24KB

Download
memory/4980-31-0x0000000005150000-0x0000000005768000-memory.dmp

Filesize
6.1MB

Download
memory/4980-32-0x0000000004BC0000-0x0000000004CCA000-memory.dmp

Filesize
1.0MB

Download
memory/4980-33-0x0000000004CF0000-0x0000000004D02000-memory.dmp

Filesize
72KB

Download
memory/4980-34-0x0000000004D10000-0x0000000004D4C000-memory.dmp

Filesize
240KB

Download
memory/4980-35-0x0000000004D80000-0x0000000004DCC000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads