File name:

malware.exe

Full analysis: https://app.any.run/tasks/659a6b24-1252-4882-90f5-0ec063fa416e
Verdict: Malicious activity
Threats:

RedLine Stealer is a malicious program that collects users’ confidential data from browsers, systems, and installed software. It also infects operating systems with other malware.

Malware Trends Tracker     >>>
Analysis date: June 01, 2025, 23:25:52
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
netreactor
stealer
redline
lefthook
teapotstealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

C526FCA4D6FAB3BAB99E20219D60118C

SHA1:

C9760CEFDD3731B087B6CA52A63BE1E3447C5393

SHA256:

4B79C2FD75E2418FAE364E07CEB081553CDDD145B3C728C3384D1E63496FD75E

SSDEEP:

24576:2vuWS6jG4E+BjNUMEXG9CbF9qFFkdw1qTGOS:2vuWS6jG4E+JNUMEXG9CbF9qFFkdw1qq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • REDLINE has been detected (SURICATA)

      • malware.exe (PID: 5064)

    • Steals credentials from Web Browsers

      • malware.exe (PID: 5064)

    • TEAPOT has been detected

      • malware.exe (PID: 5064)

    • Actions looks like stealing of personal data

      • malware.exe (PID: 5064)

    • LEFTHOOK has been detected (SURICATA)

      • malware.exe (PID: 5064)

  • SUSPICIOUS

    • Application launched itself

      • malware.exe (PID: 7128)

    • Connects to unusual port

      • malware.exe (PID: 5064)

    • Contacting a server suspected of hosting an CnC

      • malware.exe (PID: 5064)

  • INFO

    • Checks supported languages

      • malware.exe (PID: 7128)
      • malware.exe (PID: 7836)
      • malware.exe (PID: 5064)
      • malware.exe (PID: 7780)

    • .NET Reactor protector has been detected

      • malware.exe (PID: 7128)

    • Reads the machine GUID from the registry

      • malware.exe (PID: 7128)
      • malware.exe (PID: 7836)
      • malware.exe (PID: 7780)
      • malware.exe (PID: 5064)

    • Reads the computer name

      • malware.exe (PID: 7128)
      • malware.exe (PID: 5064)
      • malware.exe (PID: 7836)
      • malware.exe (PID: 7780)

    • Create files in a temporary directory

      • malware.exe (PID: 5064)

    • Manual execution by a user

      • malware.exe (PID: 7836)
      • malware.exe (PID: 7780)

    • Reads the software policy settings

      • slui.exe (PID: 2332)
      • malware.exe (PID: 5064)

    • Checks proxy server information

      • malware.exe (PID: 5064)

    • Disables trace logs

      • malware.exe (PID: 5064)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (72.2)
.scr | Windows screen saver (12.9)
.dll | Win32 Dynamic Link Library (generic) (6.4)
.exe | Win32 Executable (generic) (4.4)
.exe | Generic Win/DOS Executable (1.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:29 02:44:53+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 511488
InitializedDataSize: 7680
UninitializedDataSize: -
EntryPoint: 0x7ecfa
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.0.0.0
ProductVersionNumber: 2.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: paracode
FileDescription: Nina
FileVersion: 2.0.0.0
InternalName: JvNN.exe
LegalCopyright: Copyright © paracode 2021
LegalTrademarks: -
OriginalFileName: JvNN.exe
ProductName: Nina
ProductVersion: 2.0.0.0
AssemblyVersion: 2.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
10
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start malware.exe no specs sppextcomobj.exe no specs slui.exe rundll32.exe no specs malware.exe no specs malware.exe no specs #REDLINE malware.exe conhost.exe no specs malware.exe no specs malware.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2332"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4920"C:\Users\admin\AppData\Local\Temp\malware.exe"C:\Users\admin\AppData\Local\Temp\malware.exe—malware.exe
User:
admin
Company:
paracode
Integrity Level:
MEDIUM
Description:
Nina
Exit code:
4294967295
Version:
2.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\malware.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
5064"C:\Users\admin\AppData\Local\Temp\malware.exe"C:\Users\admin\AppData\Local\Temp\malware.exe
malware.exe
User:
admin
Company:
paracode
Integrity Level:
MEDIUM
Description:
Nina
Exit code:
0
Version:
2.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\malware.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5124\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—malware.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6108"C:\Users\admin\AppData\Local\Temp\malware.exe"C:\Users\admin\AppData\Local\Temp\malware.exe—malware.exe
User:
admin
Company:
paracode
Integrity Level:
MEDIUM
Description:
Nina
Exit code:
4294967295
Version:
2.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\malware.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6816C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
6980C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
7128"C:\Users\admin\AppData\Local\Temp\malware.exe" C:\Users\admin\AppData\Local\Temp\malware.exe—explorer.exe
User:
admin
Company:
paracode
Integrity Level:
MEDIUM
Description:
Nina
Exit code:
0
Version:
2.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\malware.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
7780"C:\Users\admin\Desktop\malware.exe" C:\Users\admin\Desktop\malware.exe—explorer.exe
User:
admin
Company:
paracode
Integrity Level:
MEDIUM
Description:
Nina
Version:
2.0.0.0
Modules
Images
c:\users\admin\desktop\malware.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
7836"C:\Users\admin\Desktop\malware.exe" C:\Users\admin\Desktop\malware.exe—explorer.exe
User:
admin
Company:
paracode
Integrity Level:
MEDIUM
Description:
Nina
Version:
2.0.0.0
Modules
Images
c:\users\admin\desktop\malware.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
3 070
Read events
3 056
Write events
14
Delete events
0

Modification events

(PID) Process:(5064) malware.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\malware_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5064) malware.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\malware_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5064) malware.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\malware_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(5064) malware.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\malware_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(5064) malware.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\malware_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(5064) malware.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\malware_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(5064) malware.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\malware_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(5064) malware.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\malware_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5064) malware.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\malware_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5064) malware.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\malware_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
0
Suspicious files
38
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
5064malware.exeC:\Users\admin\AppData\Local\Temp\tmp4E09.tmpbinary
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
5064malware.exeC:\Users\admin\AppData\Local\Temp\tmp4E41.tmpbinary
MD5:F6C33AC5E1032A0873BE7BFC65169287
SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83
5064malware.exeC:\Users\admin\AppData\Local\Temp\tmp4E1C.tmpbinary
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
5064malware.exeC:\Users\admin\AppData\Local\Temp\tmp4E1B.tmpbinary
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
5064malware.exeC:\Users\admin\AppData\Local\Temp\tmp4E0A.tmpbinary
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
5064malware.exeC:\Users\admin\AppData\Local\Temp\tmp4E1A.tmpbinary
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
5064malware.exeC:\Users\admin\AppData\Local\Temp\tmp4E2E.tmpbinary
MD5:F6C33AC5E1032A0873BE7BFC65169287
SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83
5064malware.exeC:\Users\admin\AppData\Local\Temp\tmp4E42.tmpbinary
MD5:F6C33AC5E1032A0873BE7BFC65169287
SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83
5064malware.exeC:\Users\admin\AppData\Local\Temp\tmp4E30.tmpbinary
MD5:F6C33AC5E1032A0873BE7BFC65169287
SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83
5064malware.exeC:\Users\admin\AppData\Local\Temp\tmp4E1D.tmpbinary
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
49
DNS requests
20
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6960
svchost.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5064
malware.exe
POST
200
194.156.79.17:55615
http://194.156.79.17:55615/
unknown
—
—
unknown
5064
malware.exe
POST
200
194.156.79.17:55615
http://194.156.79.17:55615/
unknown
—
—
unknown
2924
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5064
malware.exe
POST
200
194.156.79.17:55615
http://194.156.79.17:55615/
unknown
—
—
unknown
2924
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5064
malware.exe
POST
200
194.156.79.17:55615
http://194.156.79.17:55615/
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6668
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
6960
svchost.exe
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
6960
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
40.126.32.76:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
google.com
  • 142.250.186.174
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
whitelisted
www.microsoft.com
  • 23.219.150.101
  • 2.23.246.101
whitelisted
login.live.com
  • 40.126.32.76
  • 40.126.32.134
  • 20.190.160.67
  • 40.126.32.68
  • 20.190.160.20
  • 40.126.32.140
  • 20.190.160.128
  • 40.126.32.138
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
www.bing.com
  • 2.16.241.218
  • 2.16.241.201
whitelisted
th.bing.com
  • 2.23.227.208
  • 2.23.227.215
whitelisted
r.bing.com
  • 2.23.227.208
  • 2.23.227.215
whitelisted

Threats

PID
Process
Class
Message
5064
malware.exe
Malware Command and Control Activity Detected
ET MALWARE RedLine Stealer - CheckConnect Response
5064
malware.exe
A Network Trojan was detected
AV TROJAN RedLine Stealer Config Download
5064
malware.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
malware.exe