| File name: | xx.exe |
| Full analysis: | https://app.any.run/tasks/a60c827b-150d-4dd4-bb89-94395c17cbcb |
| Verdict: | Malicious activity |
| Threats: | RedLine Stealer is a malicious program that collects users’ confidential data from browsers, systems, and installed software. It also infects operating systems with other malware. |
| Analysis date: | January 29, 2025, 14:10:34 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32+ executable (GUI) x86-64, for MS Windows, 6 sections |
| MD5: | 0262725C87F48DDD757B2F4CF65D7634 |
| SHA1: | EFCF736600405850DC2D12CFE08D03D6EBE1AE0F |
| SHA256: | 5610FA3CEB68E9F6CC68CB93EB9F4FF6795010911EA9CB7B190E5C3ECF1AFAAA |
| SSDEEP: | 49152:CBMHhkZtSFGfxM1OFNqxrl+/yMtPkUM0d4tD1bxGnLg6rMD4r0U8Xd8+Y:CKBkZijI4+/LtMwHgZ |
MALICIOUS
Runs injected code in another process
- syssxavvpcp.exe (PID: 4944)
Application was injected by another process
- explorer.exe (PID: 4488)
Changes the autorun value in the registry
- syssxavvpcp.exe (PID: 4944)
- explorer.exe (PID: 4488)
- msiexec.exe (PID: 6260)
- syxxbsxtccx.exe (PID: 5488)
REDLINE mutex has been found
- msiexec.exe (PID: 6260)
SUSPICIOUS
Executable content was dropped or overwritten
- syssxavvpcp.exe (PID: 4944)
- xx.exe (PID: 3928)
- syxxbsxtccx.exe (PID: 5488)
Found regular expressions for crypto-addresses (YARA)
- syxxbsxtccx.exe (PID: 5488)
Reads security settings of Internet Explorer
- sysxxcchceck.exe (PID: 5720)
- syssxavvpcp.exe (PID: 4944)
There is functionality for taking screenshot (YARA)
- sysxxcchceck.exe (PID: 5720)
INFO
The sample compiled with english language support
- xx.exe (PID: 3928)
Checks supported languages
- xx.exe (PID: 3928)
- syssxavvpcp.exe (PID: 4944)
- syxxbsxtccx.exe (PID: 5488)
- sysxxcchceck.exe (PID: 5720)
Reads the computer name
- sysxxcchceck.exe (PID: 5720)
- syssxavvpcp.exe (PID: 4944)
Reads security settings of Internet Explorer
- explorer.exe (PID: 4488)
- msiexec.exe (PID: 6260)
Checks proxy server information
- syssxavvpcp.exe (PID: 4944)
- explorer.exe (PID: 4488)
- msiexec.exe (PID: 6260)
- sysxxcchceck.exe (PID: 5720)
Creates files or folders in the user directory
- syssxavvpcp.exe (PID: 4944)
- xx.exe (PID: 3928)
Creates files in the program directory
- syxxbsxtccx.exe (PID: 5488)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (64.6) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (15.4) |
| .exe | | | Win32 Executable (generic) (10.5) |
| .exe | | | Generic Win/DOS Executable (4.6) |
| .exe | | | DOS Executable Generic (4.6) |
EXIF
EXE
| MachineType: | AMD AMD64 |
|---|---|
| TimeStamp: | 2025:01:29 13:53:15+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware |
| PEType: | PE32+ |
| LinkerVersion: | 14.4 |
| CodeSize: | 55296 |
| InitializedDataSize: | 1478144 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x1c58 |
| OSVersion: | 6 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.2.1.1 |
| ProductVersionNumber: | 1.2.1.1 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Windows NT 32-bit |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| CompanyName: | Microsoft |
| FileDescription: | Software |
| FileVersion: | 1.2.1.1 |
| InternalName: | Software.exe |
| LegalCopyright: | (C) 2025 |
| OriginalFileName: | Software.exe |
| ProductName: | Software |
| ProductVersion: | 1.2.1.1 |
Total processes
131
Monitored processes
6
Malicious processes
5
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 3928 | "C:\Users\admin\AppData\Local\Temp\xx.exe" | C:\Users\admin\AppData\Local\Temp\xx.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Integrity Level: MEDIUM Description: Software Exit code: 0 Version: 1.2.1.1 Modules
| |||||||||||||||
| 4488 | C:\WINDOWS\Explorer.EXE | C:\Windows\explorer.exe | — | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Version: 10.0.19041.3758 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4944 | "C:\Users\admin\AppData\Roaming\syssxavvpcp.exe" | C:\Users\admin\AppData\Roaming\syssxavvpcp.exe | xx.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: System Exit code: 0 Version: 2.0.0.1 Modules
| |||||||||||||||
| 5488 | "C:\Users\admin\AppData\Roaming\syxxbsxtccx.exe" | C:\Users\admin\AppData\Roaming\syxxbsxtccx.exe | xx.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: System Version: 6.0.0.1 Modules
| |||||||||||||||
| 5720 | "C:\Users\admin\AppData\Roaming\sysxxcchceck.exe" | C:\Users\admin\AppData\Roaming\sysxxcchceck.exe | xx.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 6260 | "C:\WINDOWS\system32\msiexec.exe" | C:\Windows\System32\msiexec.exe | syssxavvpcp.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Version: 5.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
2 096
Read events
2 064
Write events
30
Delete events
2
Modification events
| (PID) Process: | (5720) sysxxcchceck.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (5720) sysxxcchceck.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (5720) sysxxcchceck.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (6260) msiexec.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | Services |
Value: C:\Users\admin\AppData\Roaming\2F33566DA0B91573532102\2F33566DA0B91573532102.exe | |||
| (PID) Process: | (4488) explorer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | (default) |
Value: C:\Users\admin\AppData\Roaming\2F33566DA0B91573532102\2F33566DA0B91573532102.exe | |||
| (PID) Process: | (4944) syssxavvpcp.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | Services |
Value: C:\Users\admin\AppData\Roaming\2F33566DA0B91573532102\2F33566DA0B91573532102.exe | |||
| (PID) Process: | (5488) syxxbsxtccx.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | SystemHandler |
Value: C:\Users\admin\AppData\Roaming\syxxbsxtccx.exe | |||
| (PID) Process: | (5488) syxxbsxtccx.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | SystemHandler |
Value: C:\ProgramData\Winsrv\winsvc.exe | |||
| (PID) Process: | (6260) msiexec.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (6260) msiexec.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\StartupFolder |
| Operation: | delete key | Name: | (default) |
Value: | |||
Executable files
5
Suspicious files
5
Text files
6
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5720 | sysxxcchceck.exe | C:\ProgramData\6830FA554F652512029130\Browsers\Chrome_History.txt | — | |
MD5:— | SHA256:— | |||
| 5720 | sysxxcchceck.exe | C:\ProgramData\6830FA554F652512029130\Browsers\Chrome_Downloads.txt | — | |
MD5:— | SHA256:— | |||
| 5720 | sysxxcchceck.exe | C:\ProgramData\6830FA554F652512029130\Browsers\Edge_Downloads.txt | — | |
MD5:— | SHA256:— | |||
| 3928 | xx.exe | C:\Users\admin\AppData\Roaming\sysxxcchceck.exe | executable | |
MD5:0535262FE0F5413494A58ACA9CE939B2 | SHA256:0E545C02F20C83526F7F7F424F527E3FAA103017CFE046C1F3B7E4CCD842829B | |||
| 3928 | xx.exe | C:\Users\admin\AppData\Roaming\syssxavvpcp.exe | executable | |
MD5:8A7AF78CEE9B6487D1CEF5ABFD008B1B | SHA256:67CCDFA102CA31649309BF0639C6DE858383B2889A0FA86C31E3AC6B3457739C | |||
| 3928 | xx.exe | C:\Users\admin\AppData\Roaming\syxxbsxtccx.exe | executable | |
MD5:421082A69F2904A743664E58906B6504 | SHA256:06E56563A4FAB2B78642CE7C5AB19C75C72B5F7E9BFB0E658E95579B75B3D2C2 | |||
| 5720 | sysxxcchceck.exe | C:\ProgramData\6830FA554F652512029130\FTP Clients\FileZilla\filezilla.xml | xml | |
MD5:32F683306CE4FA78157113BB9EACB51D | SHA256:16283B36975456118FBAC2A0CB0AB466C2D26E2B396DD938CDF129F2D3224570 | |||
| 5720 | sysxxcchceck.exe | C:\ProgramData\6830FA554F652512029130\Screenshot.jpg | binary | |
MD5:0D671D53DEAE6966497E65F1AE4DBD4D | SHA256:099A6C8DD3A3858F3CAF3CD8993DDC0E6237CE83477D076A71AD64916E5CE53E | |||
| 5488 | syxxbsxtccx.exe | C:\ProgramData\Winsrv\winsvc.exe | executable | |
MD5:421082A69F2904A743664E58906B6504 | SHA256:06E56563A4FAB2B78642CE7C5AB19C75C72B5F7E9BFB0E658E95579B75B3D2C2 | |||
| 5720 | sysxxcchceck.exe | C:\ProgramData\6830FA554F652512029130\FTP Clients\FileZilla\layout.xml | xml | |
MD5:4526724CD149C14EF9D37D86F825B9F7 | SHA256:138167D8F03D48E88DA0AEC3DF38F723BC1895822F75660CCCB5E994814BEE90 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
35
DNS requests
13
Threats
8
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
4488 | explorer.exe | GET | 200 | 185.81.68.156:80 | http://185.81.68.156/bin/bot64.bin | unknown | — | — | unknown |
4944 | syssxavvpcp.exe | GET | 200 | 176.113.115.149:80 | http://176.113.115.149/bin/bot64.bin | unknown | — | — | malicious |
4488 | explorer.exe | POST | 200 | 185.81.68.156:80 | http://185.81.68.156/VzCAHn.php?2F33566DA0B91573532102 | unknown | — | — | unknown |
5720 | sysxxcchceck.exe | POST | 200 | 185.81.68.156:80 | http://185.81.68.156/svcstealer/get.php | unknown | — | — | unknown |
4488 | explorer.exe | POST | 200 | 185.81.68.156:80 | http://185.81.68.156/VzCAHn.php?2F33566DA0B91573532102 | unknown | — | — | unknown |
5720 | sysxxcchceck.exe | POST | 200 | 185.81.68.156:80 | http://185.81.68.156/svcstealer/get.php | unknown | — | — | unknown |
5720 | sysxxcchceck.exe | POST | 200 | 185.81.68.156:80 | http://185.81.68.156/svcstealer/get.php | unknown | — | — | unknown |
7144 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
4488 | explorer.exe | POST | 200 | 185.81.68.156:80 | http://185.81.68.156/VzCAHn.php?2F33566DA0B91573532102 | unknown | — | — | unknown |
5720 | sysxxcchceck.exe | POST | 200 | 185.81.68.156:80 | http://185.81.68.156/svcstealer/get.php | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4712 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4944 | syssxavvpcp.exe | 176.113.115.149:80 | — | Red Bytes LLC | RU | malicious |
4488 | explorer.exe | 185.81.68.156:80 | — | Chang Way Technologies Co. Limited | RU | unknown |
6260 | msiexec.exe | 176.113.115.149:80 | — | Red Bytes LLC | RU | malicious |
5720 | sysxxcchceck.exe | 185.81.68.156:80 | — | Chang Way Technologies Co. Limited | RU | unknown |
5720 | sysxxcchceck.exe | 185.81.68.147:80 | — | Chang Way Technologies Co. Limited | RU | malicious |
4804 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1176 | svchost.exe | 20.190.160.20:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1176 | svchost.exe | 2.23.77.188:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
arc.msn.com |
| whitelisted |
fd.api.iris.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
4944 | syssxavvpcp.exe | Misc Attack | ET DROP Spamhaus DROP Listed Traffic Inbound group 30 |
4944 | syssxavvpcp.exe | Potentially Bad Traffic | ET HUNTING Generic .bin download from Dotted Quad |
4944 | syssxavvpcp.exe | Potentially Bad Traffic | PAYLOAD [ANY.RUN] XORed Windows executable has been loaded |
4488 | explorer.exe | Potentially Bad Traffic | PAYLOAD [ANY.RUN] XORed Windows executable has been loaded |
4488 | explorer.exe | Misc Attack | ET DROP Spamhaus DROP Listed Traffic Inbound group 31 |
4488 | explorer.exe | Potentially Bad Traffic | ET HUNTING Generic .bin download from Dotted Quad |
6260 | msiexec.exe | Potentially Bad Traffic | PAYLOAD [ANY.RUN] XORed Windows executable has been loaded |
6260 | msiexec.exe | Potentially Bad Traffic | ET HUNTING Generic .bin download from Dotted Quad |