| File name: | 23c81c824177bc39dc8131bb8c25661ffecf0026501a7d074b49ff0eabc10b25 |
| Full analysis: | https://app.any.run/tasks/fc381185-8423-4e0a-afa8-ec780910f807 |
| Verdict: | Malicious activity |
| Threats: | RedLine Stealer is a malicious program that collects users’ confidential data from browsers, systems, and installed software. It also infects operating systems with other malware. |
| Analysis date: | May 17, 2025, 14:01:32 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections |
| MD5: | 69A568A135864396940144FFF6F652CA |
| SHA1: | A9114775249469077B33353E646FEF5AA160AB11 |
| SHA256: | 23C81C824177BC39DC8131BB8C25661FFECF0026501A7D074B49FF0EABC10B25 |
| SSDEEP: | 98304:HR6wFo4nxbMWTc11n0oNjp/eniY5uikJFhtV24hyd1XwVKspSF3Edy6AQGzVD8EG:iuGxRZ2qckNFoear3d8xCurUGq0i |
MALICIOUS
REDLINE has been detected (YARA)
- vbc.exe (PID: 7012)
SUSPICIOUS
The process executes VB scripts
- 23c81c824177bc39dc8131bb8c25661ffecf0026501a7d074b49ff0eabc10b25.exe (PID: 5048)
Connects to unusual port
- vbc.exe (PID: 7012)
There is functionality for taking screenshot (YARA)
- vbc.exe (PID: 7012)
INFO
Reads the machine GUID from the registry
- vbc.exe (PID: 7012)
Reads the computer name
- vbc.exe (PID: 7012)
- 23c81c824177bc39dc8131bb8c25661ffecf0026501a7d074b49ff0eabc10b25.exe (PID: 5048)
Checks supported languages
- 23c81c824177bc39dc8131bb8c25661ffecf0026501a7d074b49ff0eabc10b25.exe (PID: 5048)
- vbc.exe (PID: 7012)
Confuser has been detected (YARA)
- vbc.exe (PID: 7012)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
RedLine
(PID) Process(7012) vbc.exe
C2 (1)5.75.177.255:23682
Options
ErrorMessage
BotnetThe version of this file is not compatible with the version of Windows you're running. Check your computer's system information to see whether you need an x86 (32-bit) or x64 (64-bit) version of the program.
Keys
XorJoseph
TRiD
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (82.9) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (7.4) |
| .exe | | | Win32 Executable (generic) (5.1) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2023:11:02 04:04:37+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 8 |
| CodeSize: | 11845120 |
| InitializedDataSize: | 391168 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xb4dd47 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 4.5.8.7128 |
| ProductVersionNumber: | 4.5.8.7128 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | This installation was built with Inno Setup. |
| CompanyName: | Canneverbe Limited |
| FileDescription: | CDBurnerXP |
| FileVersion: | 4.5.8.7128 |
| LegalCopyright: | 2001-2014 Canneverbe Limited |
| ProductName: | CDBurnerXP |
| ProductVersion: | 4.5.8.7128 |
Total processes
130
Monitored processes
3
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 3100 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5048 | "C:\Users\admin\AppData\Local\Temp\23c81c824177bc39dc8131bb8c25661ffecf0026501a7d074b49ff0eabc10b25.exe" | C:\Users\admin\AppData\Local\Temp\23c81c824177bc39dc8131bb8c25661ffecf0026501a7d074b49ff0eabc10b25.exe | — | explorer.exe | |||||||||||
User: admin Company: Canneverbe Limited Integrity Level: MEDIUM Description: CDBurnerXP Exit code: 0 Version: 4.5.8.7128 Modules
| |||||||||||||||
| 7012 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe | 23c81c824177bc39dc8131bb8c25661ffecf0026501a7d074b49ff0eabc10b25.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual Basic Command Line Compiler Version: 14.8.9037.0 Modules
RedLine(PID) Process(7012) vbc.exe C2 (1)5.75.177.255:23682 Options ErrorMessage BotnetThe version of this file is not compatible with the version of Windows you're running. Check your computer's system information to see whether you need an x86 (32-bit) or x64 (64-bit) version of the program. Keys XorJoseph | |||||||||||||||
Total events
1 669
Read events
1 669
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
22
DNS requests
14
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.216.77.26:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5256 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
5256 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 23.216.77.26:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
7012 | vbc.exe | 5.75.177.255:23682 | — | Hetzner Online GmbH | DE | unknown |
3216 | svchost.exe | 172.211.123.249:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
6544 | svchost.exe | 20.190.159.2:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 2.17.190.73:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
2104 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |