File name:

1c49763cbdf8502ee7567f68af3d8658206a6627f87ac269eceee5993b8ef8f3.exe

Full analysis: https://app.any.run/tasks/acc25d25-8f03-4848-9f98-653bd49ab72c
Verdict: Malicious activity
Threats:

RedLine Stealer is a malicious program that collects users’ confidential data from browsers, systems, and installed software. It also infects operating systems with other malware.

Malware Trends Tracker     >>>
Analysis date: April 15, 2025, 20:05:56
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
redline
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

10A768C6BD87A6F44AFF0D5D7CFA5A54

SHA1:

531F73BCDE659C8D353DD10AA8D71F5E55D0D20F

SHA256:

1C49763CBDF8502EE7567F68AF3D8658206A6627F87AC269ECEEE5993B8EF8F3

SSDEEP:

12288:38tTGct3AYGS/GcCjhupqwW5kCOT5xKsxX5FBypkw9QjuElKnEkKtWbLV5TXtTpJ:3+TG0QYGS+cC8pqwW5kCg5xKsxX5F0V

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • REDLINE has been detected (YARA)

      • MSBuild.exe (PID: 2384)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 1c49763cbdf8502ee7567f68af3d8658206a6627f87ac269eceee5993b8ef8f3.exe (PID: 2140)

    • There is functionality for taking screenshot (YARA)

      • MSBuild.exe (PID: 2384)

    • Connects to unusual port

      • MSBuild.exe (PID: 2384)

  • INFO

    • Checks supported languages

      • 1c49763cbdf8502ee7567f68af3d8658206a6627f87ac269eceee5993b8ef8f3.exe (PID: 2140)
      • MSBuild.exe (PID: 2384)

    • Reads the computer name

      • 1c49763cbdf8502ee7567f68af3d8658206a6627f87ac269eceee5993b8ef8f3.exe (PID: 2140)
      • MSBuild.exe (PID: 2384)

    • Creates files or folders in the user directory

      • 1c49763cbdf8502ee7567f68af3d8658206a6627f87ac269eceee5993b8ef8f3.exe (PID: 2140)

    • Reads the machine GUID from the registry

      • MSBuild.exe (PID: 2384)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

RedLine

(PID) Process(2384) MSBuild.exe
C2 (1)185.196.9.26:6302
Botnet@OrigKvin
Options
ErrorMessage
Keys
XorSwobbed
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:08:11 19:12:29+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 702464
InitializedDataSize: 2560
UninitializedDataSize: -
EntryPoint: 0xad68e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows command line
FileVersionNumber: 1.3.0.5
ProductVersionNumber: 1.3.0.5
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Connecting the world through cutting-edge digital solutions.
CompanyName: AetherLink Inc.
FileDescription: AetherLink Technologies
FileVersion: 1.3.0.5
InternalName: Lily902Bob.pdf
LegalCopyright: Copyright © 2024
LegalTrademarks: AetherLink Technologies Trademark
OriginalFileName: Lily902Bob.pdf
ProductName: AetherLink Advanced Suite
ProductVersion: 1.3.0.5
AssemblyVersion: 1.3.0.5
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
135
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 1c49763cbdf8502ee7567f68af3d8658206a6627f87ac269eceee5993b8ef8f3.exe conhost.exe no specs #REDLINE msbuild.exe sppextcomobj.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2136\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—1c49763cbdf8502ee7567f68af3d8658206a6627f87ac269eceee5993b8ef8f3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2140"C:\Users\admin\AppData\Local\Temp\1c49763cbdf8502ee7567f68af3d8658206a6627f87ac269eceee5993b8ef8f3.exe" C:\Users\admin\AppData\Local\Temp\1c49763cbdf8502ee7567f68af3d8658206a6627f87ac269eceee5993b8ef8f3.exe
explorer.exe
User:
admin
Company:
AetherLink Inc.
Integrity Level:
MEDIUM
Description:
AetherLink Technologies
Exit code:
0
Version:
1.3.0.5
Modules
Images
c:\users\admin\appdata\local\temp\1c49763cbdf8502ee7567f68af3d8658206a6627f87ac269eceee5993b8ef8f3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2384"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
1c49763cbdf8502ee7567f68af3d8658206a6627f87ac269eceee5993b8ef8f3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
RedLine
(PID) Process(2384) MSBuild.exe
C2 (1)185.196.9.26:6302
Botnet@OrigKvin
Options
ErrorMessage
Keys
XorSwobbed
4000C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
4880"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
1 710
Read events
1 710
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
21401c49763cbdf8502ee7567f68af3d8658206a6627f87ac269eceee5993b8ef8f3.exeC:\Users\admin\AppData\Roaming\d3d9x.dllexecutable
MD5:2F88E68A64AD162A92F6D98F3DF2D4DE
SHA256:4BCC951069B4C04DA101A34F9941CA4A3A772930413483C60E09DA139FB9DA71
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
22
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
184.24.77.37:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5960
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5960
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
184.24.77.37:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2384
MSBuild.exe
185.196.9.26:6302
—
Simple Carrier LLC
US
malicious
4208
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
20.190.160.22:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
  • 4.231.128.59
  • 20.73.194.208
whitelisted
google.com
  • 142.250.186.174
whitelisted
crl.microsoft.com
  • 184.24.77.37
  • 184.24.77.35
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.22
  • 20.190.160.132
  • 20.190.160.64
  • 40.126.32.136
  • 20.190.160.3
  • 20.190.160.128
  • 40.126.32.134
  • 20.190.160.130
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
1c49763cbdf8502ee7567f68af3d8658206a6627f87ac269eceee5993b8ef8f3.exe