File name:

0df582e409678acde44289f52c34c51ba50ad6a9cd5216a45667fa7abae11ab4

Full analysis: https://app.any.run/tasks/95905839-9efe-4bae-a462-69abbf891214
Verdict: Malicious activity
Threats:

RedLine Stealer is a malicious program that collects users’ confidential data from browsers, systems, and installed software. It also infects operating systems with other malware.

Malware Trends Tracker     >>>
Analysis date: November 10, 2024, 10:00:41
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
confuser
redline
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

37D0ECF984DA9A1D5C33E47C01038F0C

SHA1:

5062A32E6250FDD399C9392AA4640A94FEF91323

SHA256:

0DF582E409678ACDE44289F52C34C51BA50AD6A9CD5216A45667FA7ABAE11AB4

SSDEEP:

24576:zLnTKqndIXa2Q7HG+a7mX4mDhC+5oCPQpke5vOtEFe3R/9Uk3R3zjofNR:zLnemIq2Q7HG+a7o4mDhC+5oCPQpke5r

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • REDLINE has been detected (YARA)

      • 1.exe (PID: 1748)
      • lr690274.exe (PID: 2272)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • 0df582e409678acde44289f52c34c51ba50ad6a9cd5216a45667fa7abae11ab4.exe (PID: 4508)

    • Starts a Microsoft application from unusual location

      • 0df582e409678acde44289f52c34c51ba50ad6a9cd5216a45667fa7abae11ab4.exe (PID: 4508)
      • ziDL9413.exe (PID: 5896)

    • Reads security settings of Internet Explorer

      • ku450966.exe (PID: 6820)

    • Executable content was dropped or overwritten

      • ku450966.exe (PID: 6820)
      • ziDL9413.exe (PID: 5896)
      • 0df582e409678acde44289f52c34c51ba50ad6a9cd5216a45667fa7abae11ab4.exe (PID: 4508)

    • Executes application which crashes

      • ku450966.exe (PID: 6820)

    • Connects to unusual port

      • lr690274.exe (PID: 2272)
      • 1.exe (PID: 1748)

  • INFO

    • Checks supported languages

      • 0df582e409678acde44289f52c34c51ba50ad6a9cd5216a45667fa7abae11ab4.exe (PID: 4508)
      • jr154761.exe (PID: 3912)
      • ku450966.exe (PID: 6820)
      • ziDL9413.exe (PID: 5896)
      • 1.exe (PID: 1748)
      • lr690274.exe (PID: 2272)

    • Create files in a temporary directory

      • 0df582e409678acde44289f52c34c51ba50ad6a9cd5216a45667fa7abae11ab4.exe (PID: 4508)
      • ziDL9413.exe (PID: 5896)

    • Reads the machine GUID from the registry

      • ku450966.exe (PID: 6820)
      • 1.exe (PID: 1748)
      • lr690274.exe (PID: 2272)

    • Reads the computer name

      • jr154761.exe (PID: 3912)
      • ku450966.exe (PID: 6820)
      • 1.exe (PID: 1748)
      • lr690274.exe (PID: 2272)

    • The process uses the downloaded file

      • ku450966.exe (PID: 6820)

    • Process checks computer location settings

      • ku450966.exe (PID: 6820)

    • Reads the software policy settings

      • WerFault.exe (PID: 5524)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 5524)

    • Confuser has been detected (YARA)

      • 1.exe (PID: 1748)
      • lr690274.exe (PID: 2272)

    • Checks proxy server information

      • WerFault.exe (PID: 5524)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:05:24 22:49:06+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.13
CodeSize: 25600
InitializedDataSize: 640000
UninitializedDataSize: -
EntryPoint: 0x6a60
OSVersion: 10
ImageVersion: 10
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 11.0.17763.1
ProductVersionNumber: 11.0.17763.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor
FileVersion: 11.00.17763.1 (WinBuild.160101.0800)
InternalName: Wextract
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: WEXTRACT.EXE .MUI
ProductName: Internet Explorer
ProductVersion: 11.00.17763.1
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
131
Monitored processes
7
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 0df582e409678acde44289f52c34c51ba50ad6a9cd5216a45667fa7abae11ab4.exe zidl9413.exe jr154761.exe no specs ku450966.exe THREAT 1.exe werfault.exe THREAT lr690274.exe

Process information

PID
CMD
Path
Indicators
Parent process
1748"C:\Windows\Temp\1.exe" C:\Windows\Temp\1.exe
ku450966.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Nirtro CPU
Version:
15.9.1.22
Modules
Images
c:\windows\temp\1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2272C:\Users\admin\AppData\Local\Temp\IXP000.TMP\lr690274.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\lr690274.exe
0df582e409678acde44289f52c34c51ba50ad6a9cd5216a45667fa7abae11ab4.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Nirtro CPU
Version:
15.9.1.22
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\lr690274.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
3912C:\Users\admin\AppData\Local\Temp\IXP001.TMP\jr154761.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\jr154761.exe—ziDL9413.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Healer
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\ixp001.tmp\jr154761.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
4508"C:\Users\admin\Desktop\0df582e409678acde44289f52c34c51ba50ad6a9cd5216a45667fa7abae11ab4.exe" C:\Users\admin\Desktop\0df582e409678acde44289f52c34c51ba50ad6a9cd5216a45667fa7abae11ab4.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Version:
11.00.17763.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\desktop\0df582e409678acde44289f52c34c51ba50ad6a9cd5216a45667fa7abae11ab4.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
5524C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6820 -s 1464C:\Windows\SysWOW64\WerFault.exe
ku450966.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
5896C:\Users\admin\AppData\Local\Temp\IXP000.TMP\ziDL9413.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\ziDL9413.exe
0df582e409678acde44289f52c34c51ba50ad6a9cd5216a45667fa7abae11ab4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
11.00.17763.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\zidl9413.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6820C:\Users\admin\AppData\Local\Temp\IXP001.TMP\ku450966.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\ku450966.exe
ziDL9413.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\appdata\local\temp\ixp001.tmp\ku450966.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
Total events
9 441
Read events
9 441
Write events
0
Delete events
0

Modification events

No data
Executable files
5
Suspicious files
1
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
5524WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_ku450966.exe_a1d1a042c37436dfa31164d1fd9c7082e5e48045_8b6b655f_d42d7971-aa4b-43e9-a48d-8e1e97382cb6\Report.wer —
MD5:—
SHA256:—
5524WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\ku450966.exe.6820.dmp —
MD5:—
SHA256:—
45080df582e409678acde44289f52c34c51ba50ad6a9cd5216a45667fa7abae11ab4.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\ziDL9413.exeexecutable
MD5:BD112759C73EB39438D72D7A5A874CE8
SHA256:EC53A5C28A5128A6D185328EC2377769E329FCF7EF1DED698F0A487688C6742D
5896ziDL9413.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\jr154761.exeexecutable
MD5:3B13ABC3A4EA1EBC54C5D519B61F6CFC
SHA256:DB128AA1B144A15460D96EE541F9F33F0BBF3C85792E9F81117E1985DEC8C35E
5896ziDL9413.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\ku450966.exeexecutable
MD5:9A3E69DF95B946ED868B76FB10A8B831
SHA256:7FAFEC8C7FE347359DCEE0F5522F41A1761AA8B70BC019B3CCF9E95E5CD5D1BD
5524WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERC84A.tmp.dmpbinary
MD5:EE270A0B76ED6040C2F999E6A62C2BF8
SHA256:93AE8745A4807D50B43B88F6B5D47A05392972FE2AF7DBE0E08CC6999D439FBF
45080df582e409678acde44289f52c34c51ba50ad6a9cd5216a45667fa7abae11ab4.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\lr690274.exeexecutable
MD5:329E0E0955C1AEFF45D19E90357606BF
SHA256:A0B3487D129068A8CCF643E12EE2C66A4D536AF959395BD542714BE3DEE70F8E
6820ku450966.exeC:\Windows\Temp\1.exeexecutable
MD5:1073B2E7F778788852D3F7BB79929882
SHA256:C46EF7B768C697E57D379DDFDFD3FB4931BF3D535730EF60FECA9332E7A19FEB
5524WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERCA5E.tmp.WERInternalMetadata.xmlxml
MD5:2B36E187CAD5BFEA8EF52D8BA8C133DA
SHA256:E9925376BC301D01DF39D6DF97D72434E5FE052979F1C0575CC8C19CC82095D4
5524WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERCABD.tmp.xmlxml
MD5:4AC22B5DA6D84700FC81276FBD6C9A94
SHA256:480658CF7A9232C21AABBDBABBDD521D4F3E990720C147955EEEB9780719BBD6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
32
DNS requests
8
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6944
svchost.exe
GET
200
2.16.164.106:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
2.16.164.106:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
864
RUXIMICS.exe
GET
200
2.16.164.106:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
864
RUXIMICS.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6944
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
864
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5488
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.23.209.144:443
www.bing.com
Akamai International B.V.
GB
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5488
MoUsoCoreWorker.exe
2.16.164.106:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
6944
svchost.exe
2.16.164.106:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
864
RUXIMICS.exe
2.16.164.106:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
6944
svchost.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
www.bing.com
  • 2.23.209.144
  • 2.23.209.141
  • 2.23.209.193
  • 2.23.209.150
  • 2.23.209.135
  • 2.23.209.130
  • 2.23.209.149
  • 2.23.209.133
  • 2.23.209.140
whitelisted
google.com
  • 142.250.186.110
whitelisted
crl.microsoft.com
  • 2.16.164.106
  • 2.16.164.18
  • 2.16.164.114
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted
watson.events.data.microsoft.com
  • 104.208.16.94
whitelisted
self.events.data.microsoft.com
  • 51.116.246.104
whitelisted

Threats

PID
Process
Class
Message
1748
1.exe
Potentially Bad Traffic
ET INFO Microsoft net.tcp Connection Initialization Activity
2272
lr690274.exe
Potentially Bad Traffic
ET INFO Microsoft net.tcp Connection Initialization Activity
1748
1.exe
Potentially Bad Traffic
ET INFO Microsoft net.tcp Connection Initialization Activity
2272
lr690274.exe
Potentially Bad Traffic
ET INFO Microsoft net.tcp Connection Initialization Activity
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
0df582e409678acde44289f52c34c51ba50ad6a9cd5216a45667fa7abae11ab4