redline | d1b138a211d4b9ce4d825f82669ba211e585a87eec0e877a2b8ef87a9e43ccb6

Analysis

max time kernel
125s
max time network
124s
platform
windows10_x64
resource
win10-en-20211014
submitted
24/10/2021, 15:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GenshinHack.exe
Size 4.6MB
Sample211024-syl8vsfddl
SHA256 d1b138a211d4b9ce4d825f82669ba211e585a87eec0e877a2b8ef87a9e43ccb6
MD5 e0cfd7368fe27985e8df3605d46aca15
SHA1 1c7d84c4702540d46b8b7557b94d65f97a1cf0f1
SHA512 1d959385c46079ad0999650f83de687f00522e4cc45bf1e96077cae9e8564f398d6a7a0671a3cfa3bb9ecc37a996d9b1e2fd34b01ba0c8437a75f54db0dd55eb
MD5 SHA1 SHA512

Score

10^/10

redline @cherryvishny infostealer spyware vmprotect

Malware Config

Extracted

Family

redline

Botnet

@CherryVishny

185.209.22.181:29234

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

resource	yara_rule
behavioral2/memory/732-121-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral2/memory/732-126-0x0000000000419A6E-mapping.dmp	family_redline

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2948 created 656	2948	WerFault.exe	67

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
3900	build.exe
1368	services32.exe
4000	sihost32.exe

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x000400000001ab91-414.dat	vmprotect
behavioral2/files/0x000400000001ab91-415.dat	vmprotect
behavioral2/files/0x000600000001ab94-519.dat	vmprotect
behavioral2/files/0x000600000001ab94-520.dat	vmprotect

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 656 set thread context of 732	656	GenshinHack.exe	68

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2948	656	WerFault.exe	67

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3176	schtasks.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
656	GenshinHack.exe
656	GenshinHack.exe
656	GenshinHack.exe
656	GenshinHack.exe
2948	WerFault.exe
2948	WerFault.exe
2948	WerFault.exe
2948	WerFault.exe
2948	WerFault.exe
2948	WerFault.exe
2948	WerFault.exe
2948	WerFault.exe
2948	WerFault.exe
2948	WerFault.exe
2948	WerFault.exe
2948	WerFault.exe
732	AppLaunch.exe
3900	build.exe
3900	build.exe
1684	conhost.exe
3296	powershell.exe
3296	powershell.exe
3296	powershell.exe
3872	powershell.exe
3872	powershell.exe
3872	powershell.exe
1368	services32.exe
1368	services32.exe
3636	conhost.exe
3636	conhost.exe
2188	powershell.exe
2188	powershell.exe
2188	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	2948	WerFault.exe
Token: SeBackupPrivilege	2948	WerFault.exe
Token: SeDebugPrivilege	2948	WerFault.exe
Token: SeDebugPrivilege	732	AppLaunch.exe
Token: SeDebugPrivilege	1684	conhost.exe
Token: SeDebugPrivilege	3296	powershell.exe
Token: SeIncreaseQuotaPrivilege	3296	powershell.exe
Token: SeSecurityPrivilege	3296	powershell.exe
Token: SeTakeOwnershipPrivilege	3296	powershell.exe
Token: SeLoadDriverPrivilege	3296	powershell.exe
Token: SeSystemProfilePrivilege	3296	powershell.exe
Token: SeSystemtimePrivilege	3296	powershell.exe
Token: SeProfSingleProcessPrivilege	3296	powershell.exe
Token: SeIncBasePriorityPrivilege	3296	powershell.exe
Token: SeCreatePagefilePrivilege	3296	powershell.exe
Token: SeBackupPrivilege	3296	powershell.exe
Token: SeRestorePrivilege	3296	powershell.exe
Token: SeShutdownPrivilege	3296	powershell.exe
Token: SeDebugPrivilege	3296	powershell.exe
Token: SeSystemEnvironmentPrivilege	3296	powershell.exe
Token: SeRemoteShutdownPrivilege	3296	powershell.exe
Token: SeUndockPrivilege	3296	powershell.exe
Token: SeManageVolumePrivilege	3296	powershell.exe
Token: 33	3296	powershell.exe
Token: 34	3296	powershell.exe
Token: 35	3296	powershell.exe
Token: 36	3296	powershell.exe
Token: SeDebugPrivilege	3872	powershell.exe
Token: SeIncreaseQuotaPrivilege	3872	powershell.exe
Token: SeSecurityPrivilege	3872	powershell.exe
Token: SeTakeOwnershipPrivilege	3872	powershell.exe
Token: SeLoadDriverPrivilege	3872	powershell.exe
Token: SeSystemProfilePrivilege	3872	powershell.exe
Token: SeSystemtimePrivilege	3872	powershell.exe
Token: SeProfSingleProcessPrivilege	3872	powershell.exe
Token: SeIncBasePriorityPrivilege	3872	powershell.exe
Token: SeCreatePagefilePrivilege	3872	powershell.exe
Token: SeBackupPrivilege	3872	powershell.exe
Token: SeRestorePrivilege	3872	powershell.exe
Token: SeShutdownPrivilege	3872	powershell.exe
Token: SeDebugPrivilege	3872	powershell.exe
Token: SeSystemEnvironmentPrivilege	3872	powershell.exe
Token: SeRemoteShutdownPrivilege	3872	powershell.exe
Token: SeUndockPrivilege	3872	powershell.exe
Token: SeManageVolumePrivilege	3872	powershell.exe
Token: 33	3872	powershell.exe
Token: 34	3872	powershell.exe
Token: 35	3872	powershell.exe
Token: 36	3872	powershell.exe
Token: SeDebugPrivilege	3636	conhost.exe
Token: SeDebugPrivilege	2188	powershell.exe
Token: SeIncreaseQuotaPrivilege	2188	powershell.exe
Token: SeSecurityPrivilege	2188	powershell.exe
Token: SeTakeOwnershipPrivilege	2188	powershell.exe
Token: SeLoadDriverPrivilege	2188	powershell.exe
Token: SeSystemProfilePrivilege	2188	powershell.exe
Token: SeSystemtimePrivilege	2188	powershell.exe
Token: SeProfSingleProcessPrivilege	2188	powershell.exe
Token: SeIncBasePriorityPrivilege	2188	powershell.exe
Token: SeCreatePagefilePrivilege	2188	powershell.exe
Token: SeBackupPrivilege	2188	powershell.exe
Token: SeRestorePrivilege	2188	powershell.exe
Token: SeShutdownPrivilege	2188	powershell.exe
Token: SeDebugPrivilege	2188	powershell.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 656 wrote to memory of 732	656	GenshinHack.exe	68
PID 656 wrote to memory of 732	656	GenshinHack.exe	68
PID 656 wrote to memory of 732	656	GenshinHack.exe	68
PID 656 wrote to memory of 732	656	GenshinHack.exe	68
PID 656 wrote to memory of 732	656	GenshinHack.exe	68
PID 732 wrote to memory of 3900	732	AppLaunch.exe	73
PID 732 wrote to memory of 3900	732	AppLaunch.exe	73
PID 3900 wrote to memory of 1684	3900	build.exe	74
PID 3900 wrote to memory of 1684	3900	build.exe	74
PID 3900 wrote to memory of 1684	3900	build.exe	74
PID 1684 wrote to memory of 3524	1684	conhost.exe	75
PID 1684 wrote to memory of 3524	1684	conhost.exe	75
PID 3524 wrote to memory of 3296	3524	cmd.exe	77
PID 3524 wrote to memory of 3296	3524	cmd.exe	77
PID 1684 wrote to memory of 2536	1684	conhost.exe	78
PID 1684 wrote to memory of 2536	1684	conhost.exe	78
PID 2536 wrote to memory of 3176	2536	cmd.exe	80
PID 2536 wrote to memory of 3176	2536	cmd.exe	80
PID 3524 wrote to memory of 3872	3524	cmd.exe	82
PID 3524 wrote to memory of 3872	3524	cmd.exe	82
PID 1684 wrote to memory of 1756	1684	conhost.exe	83
PID 1684 wrote to memory of 1756	1684	conhost.exe	83
PID 1756 wrote to memory of 1368	1756	cmd.exe	85
PID 1756 wrote to memory of 1368	1756	cmd.exe	85
PID 1368 wrote to memory of 3636	1368	services32.exe	88
PID 1368 wrote to memory of 3636	1368	services32.exe	88
PID 1368 wrote to memory of 3636	1368	services32.exe	88
PID 3636 wrote to memory of 2984	3636	conhost.exe	89
PID 3636 wrote to memory of 2984	3636	conhost.exe	89
PID 2984 wrote to memory of 2188	2984	cmd.exe	91
PID 2984 wrote to memory of 2188	2984	cmd.exe	91
PID 3636 wrote to memory of 4000	3636	conhost.exe	92
PID 3636 wrote to memory of 4000	3636	conhost.exe	92
PID 2984 wrote to memory of 1048	2984	cmd.exe	93
PID 2984 wrote to memory of 1048	2984	cmd.exe	93
PID 4000 wrote to memory of 3080	4000	sihost32.exe	94
PID 4000 wrote to memory of 3080	4000	sihost32.exe	94
PID 4000 wrote to memory of 3080	4000	sihost32.exe	94

C:\Users\Admin\AppData\Local\Temp\GenshinHack.exe
"C:\Users\Admin\AppData\Local\Temp\GenshinHack.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:656
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:732
- - C:\Users\Admin\AppData\Local\Temp\build.exe
    "C:\Users\Admin\AppData\Local\Temp\build.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3900
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\build.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1684
    - - C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3524
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3296
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3872
    - - C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Users\Admin\services32.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2536
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Users\Admin\services32.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:3176
    - - C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c "C:\Users\Admin\services32.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1756
      - C:\Users\Admin\services32.exe
        
        C:\Users\Admin\services32.exe
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1368
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\\conhost.exe" "C:\Users\Admin\services32.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3636
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2984
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        9⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2188
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1048
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4000
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\\conhost.exe" "/sihost32"
        9⤵
        
        PID:3080
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 656 -s 248
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/656-115-0x0000000000D30000-0x0000000000D31000-memory.dmp

Download

memory/656-116-0x0000000000D40000-0x0000000000D41000-memory.dmp

Download

memory/656-117-0x0000000000D50000-0x0000000000D51000-memory.dmp

Download

memory/656-118-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

Download

memory/656-119-0x0000000001100000-0x0000000001101000-memory.dmp

Download

memory/656-120-0x0000000001110000-0x0000000001111000-memory.dmp

Download

memory/732-145-0x000000000A260000-0x000000000A261000-memory.dmp

Download

memory/732-130-0x0000000000400000-0x0000000000401000-memory.dmp

Download

memory/732-142-0x0000000009970000-0x0000000009971000-memory.dmp

Download

memory/732-143-0x0000000009A90000-0x0000000009A91000-memory.dmp

Download

memory/732-144-0x000000000A640000-0x000000000A641000-memory.dmp

Download

memory/732-121-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/732-146-0x000000000A530000-0x000000000A531000-memory.dmp

Download

memory/732-137-0x0000000009650000-0x0000000009651000-memory.dmp

Download

memory/732-136-0x0000000009520000-0x0000000009B26000-memory.dmp

Download

memory/732-127-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Download

memory/732-128-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Download

memory/732-129-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Download

memory/732-138-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Download

memory/732-135-0x0000000009610000-0x0000000009611000-memory.dmp

Download

memory/732-132-0x0000000009B30000-0x0000000009B31000-memory.dmp

Download

memory/732-133-0x00000000095B0000-0x00000000095B1000-memory.dmp

Download

memory/732-134-0x00000000096E0000-0x00000000096E1000-memory.dmp

Download

memory/1048-605-0x0000018F7EC50000-0x0000018F7EC52000-memory.dmp

Download

memory/1048-606-0x0000018F7EC53000-0x0000018F7EC55000-memory.dmp

Download

memory/1048-633-0x0000018F7EC58000-0x0000018F7EC59000-memory.dmp

Download

memory/1048-632-0x0000018F7EC56000-0x0000018F7EC58000-memory.dmp

Download

memory/1684-446-0x0000024810416000-0x0000024810417000-memory.dmp

Download

memory/1684-444-0x0000024810410000-0x0000024810412000-memory.dmp

Download

memory/1684-445-0x0000024810413000-0x0000024810415000-memory.dmp

Download

memory/1684-420-0x0000024810160000-0x000002481016F000-memory.dmp

Download

memory/2188-604-0x000001FF77BF8000-0x000001FF77BF9000-memory.dmp

Download

memory/2188-590-0x000001FF77BF6000-0x000001FF77BF8000-memory.dmp

Download

memory/2188-548-0x000001FF77BF3000-0x000001FF77BF5000-memory.dmp

Download

memory/2188-545-0x000001FF77BF0000-0x000001FF77BF2000-memory.dmp

Download

memory/3080-643-0x00000228EF970000-0x00000228EF972000-memory.dmp

Download

memory/3080-644-0x00000228EF973000-0x00000228EF975000-memory.dmp

Download

memory/3080-642-0x00000228D5360000-0x00000228D5367000-memory.dmp

Download

memory/3080-645-0x00000228EF976000-0x00000228EF977000-memory.dmp

Download

memory/3296-471-0x0000014A3D556000-0x0000014A3D558000-memory.dmp

Download

memory/3296-488-0x0000014A3D558000-0x0000014A3D559000-memory.dmp

Download

memory/3296-447-0x0000014A3D550000-0x0000014A3D552000-memory.dmp

Download

memory/3296-448-0x0000014A3D553000-0x0000014A3D555000-memory.dmp

Download

memory/3636-543-0x0000019D0CAF6000-0x0000019D0CAF7000-memory.dmp

Download

memory/3636-542-0x0000019D0CAF3000-0x0000019D0CAF5000-memory.dmp

Download

memory/3636-541-0x0000019D0CAF0000-0x0000019D0CAF2000-memory.dmp

Download

memory/3872-514-0x000001D7F7BE8000-0x000001D7F7BE9000-memory.dmp

Download

memory/3872-489-0x000001D7F7BE6000-0x000001D7F7BE8000-memory.dmp

Download

memory/3872-490-0x000001D7F7BE0000-0x000001D7F7BE2000-memory.dmp

Download

memory/3872-492-0x000001D7F7BE3000-0x000001D7F7BE5000-memory.dmp

Download

memory/3900-419-0x00007FF8AEB80000-0x00007FF8AEB82000-memory.dmp

Download