Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Oct. 7, 2023, 4:12 p.m.	Oct. 7, 2023, 4:23 p.m.

Size	95.5KB
Type	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`0bebf37eba1580ce4dc19a70f135572d`
SHA256	`e87d6742cd04e19b39c5076c18276c41180e33135f1b6dcb047ecc5bf435a0f8`
CRC32	`F4E2F7A1`
ssdeep	`1536:9qsINqLGlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2B3teulgS6pY:rAMOY3+zi0ZbYe1g0ujyzdZY`
Yara	detect_Redline_Stealer_V2 - (no description) UPX_Zero - UPX packed file MALWARE_Win_VT_RedLine - Detects RedLine infostealer PE_Header_Zero - PE File Signature IsPE32 - (no description) Is_DotNET_EXE - (no description) Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult RedLine_Stealer_b_Zero - RedLine stealer OS_Processor_Check_Zero - OS Processor Check

build12345.exe "C:\Users\test22\AppData\Local\Temp\build12345.exe"
1940

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
54.91.200.119	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 7, 2023, 4:12 p.m.			0	0
IsDebuggerPresent Oct. 7, 2023, 4:12 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey Oct. 7, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006e0088 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006e0088 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2023, 4:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006e0108 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 7, 2023, 4:12 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (28 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Oct. 7, 2023, 4:12 p.m.	process_identifier: 1940 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00790000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2023, 4:12 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00950000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 7, 2023, 4:12 p.m.	process_identifier: 1940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 7, 2023, 4:12 p.m.	process_identifier: 1940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2023, 4:12 p.m.	process_identifier: 1940 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00990000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2023, 4:12 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2023, 4:12 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00402000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2023, 4:12 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00645000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2023, 4:12 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0064b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2023, 4:12 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00647000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2023, 4:12 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0041c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2023, 4:12 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2023, 4:12 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00426000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2023, 4:12 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2023, 4:12 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2023, 4:12 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00427000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2023, 4:12 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2023, 4:12 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0041a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2023, 4:12 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2023, 4:12 p.m.	process_identifier: 1940 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2023, 4:12 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2023, 4:12 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2023, 4:12 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2023, 4:12 p.m.	process_identifier: 1940 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2023, 4:12 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2023, 4:12 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b51000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2023, 4:12 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00428000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2023, 4:12 p.m.	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Oct. 7, 2023, 4:12 p.m.	flags: 15 family: 0		111	0

Communicates with host for which no DNS query was performed (1 event)

host

54.91.200.119

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

54.91.200.119:18448

File has been identified by 63 AntiVirus engines on VirusTotal as malicious (50 out of 63 events)

Bkav	W32.YopeaJonD.Trojan
Lionic	Trojan.Win32.Reline.4!c
Elastic	Windows.Trojan.RedLineStealer
DrWeb	Trojan.PWS.Stealer.32288
MicroWorld-eScan	Trojan.GenericKD.63885143
CAT-QuickHeal	Trojan.MsilFC.S24736542
McAfee	GenericRXPZ-SW!0BEBF37EBA15
Malwarebytes	RedlineStealer.Spyware.Stealer.DDS
Zillya	Trojan.Agent.Win32.2456689
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	TrojanPSW:MSIL/RedLine.48b639a2
K7GW	Spyware ( 0057a2d41 )
K7AntiVirus	Spyware ( 0057a2d41 )
Arcabit	Trojan.Generic.D3CECF57
BitDefenderTheta	Gen:NN.ZemsilF.36738.fm0@a0eAD!c
VirIT	Trojan.Win32.MSIL.DGU
Cyren	W32/MSIL_Agent.BJO.gen!Eldorado
Symantec	Trojan Horse
tehtris	Generic.Malware
ESET-NOD32	a variant of MSIL/Spy.RedLine.A
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Malware.Bulz-9880537-0
Kaspersky	HEUR:Trojan-PSW.MSIL.Reline.gen
BitDefender	Trojan.GenericKD.63885143
NANO-Antivirus	Trojan.Win32.Reline.kbmsrg
SUPERAntiSpyware	Trojan.Agent/Gen-Crypt
Avast	Win32:MalwareX-gen [Trj]
Tencent	Trojan-PSW.MSIL.Reline.ha
Emsisoft	Trojan-Spy.Agent (A)
F-Secure	Heuristic.HEUR/AGEN.1305503
VIPRE	Trojan.GenericKD.63885143
TrendMicro	TrojanSpy.Win32.REDLINE.YXDJEZ
McAfee-GW-Edition	BehavesLike.Win32.Generic.nm
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.0bebf37eba1580ce
Sophos	Mal/Reline-B
SentinelOne	Static AI - Malicious PE
Jiangmin	Trojan.PSW.MSIL.cihh
Avira	HEUR/AGEN.1305503
MAX	malware (ai score=81)
Antiy-AVL	Trojan[Spy]/MSIL.Agent
Gridinsoft	Malware.Win32.RedLine.bot
Microsoft	PWS:MSIL/RedLine!atmn
ViRobot	Trojan.Win.Z.Redline.97792.ZF
ZoneAlarm	HEUR:Trojan-PSW.MSIL.Reline.gen
GData	MSIL.Trojan-Stealer.Redline.B
Google	Detected
AhnLab-V3	Infostealer/Win.RedLine.C4566112

build12345.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All