analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exe

Full analysis: https://app.any.run/tasks/bdb35390-dc89-41ac-920a-4848e4cf79f4
Verdict: Malicious activity
Threats:

RedLine Stealer is a malicious program that collects users’ confidential data from browsers, systems, and installed software. It also infects operating systems with other malware.

Analysis date: May 26, 2024, 01:52:43
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
redline
stealer
evasion
lefthook
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

17237DD481939C25479CEB40829B8787

SHA1:

EA028F7A3D50429F42951D0F50B95E4499BA7B9B

SHA256:

439B03292B559386DB6CBDC8D20C3B014206968190B637F3C18ED9360A3ECDC1

SSDEEP:

1536:TziRZxMw1fdLG6jejoigIvgPX0xbCFQUi3O5LzgAsG5nyygacStW+W+iiiiiiiiX:q1Mw19YvIz73Rg0ujyzd+S

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Drops the executable file immediately after the start

      • 439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exe (PID: 4740)
    • REDLINE has been detected (YARA)

      • 439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exe (PID: 4740)
    • Steals credentials from Web Browsers

      • 439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exe (PID: 4740)
    • Actions looks like stealing of personal data

      • 439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exe (PID: 4740)
  • SUSPICIOUS

    • Connects to unusual port

      • 439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exe (PID: 4740)
    • Checks for external IP

      • 439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exe (PID: 4740)
    • Device Retrieving External IP Address Detected

      • 439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exe (PID: 4740)
    • Potential Corporate Privacy Violation

      • 439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exe (PID: 4740)
    • Searches for installed software

      • 439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exe (PID: 4740)
  • INFO

    • Reads the computer name

      • 439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exe (PID: 4740)
    • Checks supported languages

      • 439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exe (PID: 4740)
    • Reads the machine GUID from the registry

      • 439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exe (PID: 4740)
    • Reads Environment values

      • 439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exe (PID: 4740)
    • Reads the software policy settings

      • 439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exe (PID: 4740)
      • slui.exe (PID: 6852)
    • Checks proxy server information

      • 439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exe (PID: 4740)
    • Disables trace logs

      • 439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exe (PID: 4740)
    • Create files in a temporary directory

      • 439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exe (PID: 4740)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

RedLine

(PID) Process(4740) 439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exe
C2 (1)94.156.8.186:37552
Botnetmetin2
Keys
Xor
Options
ErrorMessage
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

AssemblyVersion: 0.0.0.0
ProductVersion: 0.0.0.0
OriginalFileName: Implosions.exe
LegalCopyright:
InternalName: Implosions.exe
FileVersion: 0.0.0.0
FileDescription:
CharacterSet: Unicode
LanguageCode: Neutral
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 0.0.0.0
FileVersionNumber: 0.0.0.0
Subsystem: Windows command line
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x1932e
UninitializedDataSize: -
InitializedDataSize: 2048
CodeSize: 95232
LinkerVersion: 48
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2097:08:14 23:34:58+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
131
Monitored processes
5
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #REDLINE 439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exe conhost.exe no specs sppextcomobj.exe no specs slui.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
4740"C:\Users\admin\AppData\Local\Temp\439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exe" C:\Users\admin\AppData\Local\Temp\439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
RedLine
(PID) Process(4740) 439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exe
C2 (1)94.156.8.186:37552
Botnetmetin2
Keys
Xor
Options
ErrorMessage
5932\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6820C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exesvchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
6852"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7064C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
3 529
Read events
3 513
Write events
16
Delete events
0

Modification events

(PID) Process:(4740) 439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(4740) 439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4740) 439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4740) 439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(4740) 439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(4740) 439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(4740) 439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(4740) 439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(4740) 439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4740) 439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
0
Suspicious files
8
Text files
0
Unknown types
30

Dropped files

PID
Process
Filename
Type
4740439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exeC:\Users\admin\AppData\Local\Temp\tmp84DD.tmpbinary
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
4740439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exeC:\Users\admin\AppData\Local\Temp\tmp8558.tmpsqlite
MD5:F6C33AC5E1032A0873BE7BFC65169287
SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83
4740439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exeC:\Users\admin\AppData\Local\Temp\tmp8533.tmpsqlite
MD5:F6C33AC5E1032A0873BE7BFC65169287
SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83
4740439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exeC:\Users\admin\AppData\Local\Temp\tmp84FF.tmpbinary
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
4740439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exeC:\Users\admin\AppData\Local\Temp\tmp84ED.tmpsqlite
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
4740439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exeC:\Users\admin\AppData\Local\Temp\tmp857B.tmpsqlite
MD5:29A644B1F0D96166A05602FE27B3F4AD
SHA256:BF96902FEB97E990A471492F78EE8386BCF430D66BDAEFDEAFBF912C8CF7CE46
4740439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exeC:\Users\admin\AppData\Local\Temp\tmp8510.tmpsqlite
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
4740439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exeC:\Users\admin\AppData\Local\Temp\tmp850F.tmpsqlite
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
4740439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exeC:\Users\admin\AppData\Local\Temp\tmp84FE.tmpbinary
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
4740439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exeC:\Users\admin\AppData\Local\Temp\tmp8511.tmpsqlite
MD5:F6C33AC5E1032A0873BE7BFC65169287
SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
55
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1608
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
unknown
4740
439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exe
POST
200
94.156.8.186:37552
http://94.156.8.186:37552/
unknown
unknown
4264
svchost.exe
GET
200
23.57.85.110:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
unknown
4264
svchost.exe
GET
200
2.23.176.47:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
unknown
4740
439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exe
POST
200
94.156.8.186:37552
http://94.156.8.186:37552/
unknown
unknown
4740
439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exe
POST
200
94.156.8.186:37552
http://94.156.8.186:37552/
unknown
unknown
6628
SIHClient.exe
GET
200
23.57.85.110:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
unknown
6628
SIHClient.exe
GET
200
23.57.85.110:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
unknown
1176
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
unknown
4740
439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exe
POST
200
94.156.8.186:37552
http://94.156.8.186:37552/
unknown
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
whitelisted
4264
svchost.exe
4.231.128.59:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5632
RUXIMICS.exe
4.231.128.59:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5140
MoUsoCoreWorker.exe
4.231.128.59:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4364
svchost.exe
239.255.255.250:1900
unknown
4740
439b03292b559386db6cbdc8d20c3b014206968190b637f3c18ed9360a3ecdc1.exe
94.156.8.186:37552
Vivacom
BG
malicious
4264
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4264
svchost.exe
2.23.176.47:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
4264
svchost.exe
23.57.85.110:80
www.microsoft.com
TELECOM ITALIA SPARKLE S.p.A.
IT
unknown
1608
svchost.exe
20.190.160.22:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.23.176.47
  • 2.23.176.23
whitelisted
www.microsoft.com
  • 23.57.85.110
whitelisted
login.live.com
  • 20.190.160.22
  • 20.190.160.17
  • 20.190.160.14
  • 40.126.32.140
  • 40.126.32.136
  • 40.126.32.74
  • 40.126.32.72
  • 40.126.32.68
whitelisted
go.microsoft.com
  • 23.57.85.175
whitelisted
api.ip.sb
  • 104.26.12.31
  • 172.67.75.172
  • 104.26.13.31
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
slscr.update.microsoft.com
  • 13.85.23.86
whitelisted
r.bing.com
  • 23.222.16.9
  • 23.222.16.35
  • 23.222.16.58
  • 23.222.16.57
  • 23.222.16.42
  • 23.222.16.97
  • 23.222.16.25
  • 23.222.16.10
  • 23.222.16.17
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

PID
Process
Class
Message
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 15
Malware Command and Control Activity Detected
ET MALWARE RedLine Stealer - CheckConnect Response
A Network Trojan was detected
AV TROJAN RedLine Stealer Config Download
Malware Command and Control Activity Detected
ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound
6 ETPRO signatures available at the full report
No debug info