redline | 9f19545d8889efd62be9758e9cbd22ff09888bc33f2620cd06ea53b38b6dd7ab

Analysis

max time kernel
47s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05-11-2022 00:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Genshin Hack.exe
Size

2.4MB
MD5

8bb7c084f59ab5aff2cea25e896f2c28
SHA1

daa10447d18fe74c3c09b2a6f33bd360786ba405
SHA256

9b56130e04475a3ec48bea0777ca87743d6401a385deca1c40a17ebbf099bffc
SHA512

41a9100242490687c6c9614a8ff4b191c1579f9b59fa006580e0ba3d09fa7fcefd641d327b832c475668c4cee7ac8a635a01718660d09facd1fc120261b26e96
SSDEEP

24576:TdNxL1Y7YD1Osnk3MtIvQYMYhBQOy4MNFJNXIrPOmgPLVjGH2NJpl3RuQ553132:TdNxyDcnNjNXILOmgP9pl3c

Score

10^/10

redline 1637872939_99 infostealer

Malware Config

Extracted

Family

redline

Botnet

1637872939_99

spartanlivestyle.xyz:37397

Attributes

auth_value
a23aa6cf6d257f6cf326ea13d88a1b4b

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

resource	yara_rule
behavioral1/memory/844-56-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/844-61-0x000000000041B4FE-mapping.dmp	family_redline
behavioral1/memory/844-62-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/844-63-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1204 set thread context of 844	1204	Genshin Hack.exe	28

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 844	1204	Genshin Hack.exe	28
PID 1204 wrote to memory of 844	1204	Genshin Hack.exe	28
PID 1204 wrote to memory of 844	1204	Genshin Hack.exe	28
PID 1204 wrote to memory of 844	1204	Genshin Hack.exe	28
PID 1204 wrote to memory of 844	1204	Genshin Hack.exe	28
PID 1204 wrote to memory of 844	1204	Genshin Hack.exe	28

C:\Users\Admin\AppData\Local\Temp\Genshin Hack.exe
"C:\Users\Admin\AppData\Local\Temp\Genshin Hack.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/844-54-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/844-56-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/844-61-0x000000000041B4FE-mapping.dmp

Download
memory/844-62-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/844-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/844-64-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download